Windows Analysis Report
file.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: file.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.file.exe.630000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.2125481379.0000000000632000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.3414135593.00000000129A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\java.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD34819469	0_2_00007FFD34819469
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD348160C6	0_2_00007FFD348160C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD34824605	0_2_00007FFD34824605
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD34821A4A	0_2_00007FFD34821A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD348112F8	0_2_00007FFD348112F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD34811719	0_2_00007FFD34811719
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD34817272	0_2_00007FFD34817272
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD348113CD	0_2_00007FFD348113CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD348120F5	0_2_00007FFD348120F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD3481108D	0_2_00007FFD3481108D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD34809EF3	2_2_00007FFD34809EF3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD3480947D	2_2_00007FFD3480947D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD34808E2C	2_2_00007FFD34808E2C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD34805EFA	2_2_00007FFD34805EFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD3480AB25	2_2_00007FFD3480AB25
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD3480B7DC	2_2_00007FFD3480B7DC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD347F71FB	6_2_00007FFD347F71FB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD347F5BFA	6_2_00007FFD347F5BFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD347F6FAD	6_2_00007FFD347F6FAD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD34828503	10_2_00007FFD34828503
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD3482947D	10_2_00007FFD3482947D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD34828E05	10_2_00007FFD34828E05
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FFD348125ED	16_2_00007FFD348125ED
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FFD348189F2	16_2_00007FFD348189F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FFD348135FA	16_2_00007FFD348135FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FFD348171FB	16_2_00007FFD348171FB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FFD34815BFA	16_2_00007FFD34815BFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FFD348E3330	16_2_00007FFD348E3330
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 20_2_00007FFD348112F8	20_2_00007FFD348112F8
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 20_2_00007FFD34811719	20_2_00007FFD34811719
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 20_2_00007FFD348120F5	20_2_00007FFD348120F5
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 20_2_00007FFD34811038	20_2_00007FFD34811038
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 21_2_00007FFD348012F8	21_2_00007FFD348012F8
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 21_2_00007FFD34801719	21_2_00007FFD34801719
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 21_2_00007FFD348020F5	21_2_00007FFD348020F5
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 21_2_00007FFD34801038	21_2_00007FFD34801038
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 22_2_00007FFD347F12F8	22_2_00007FFD347F12F8
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 22_2_00007FFD347F1719	22_2_00007FFD347F1719
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 22_2_00007FFD347F20F5	22_2_00007FFD347F20F5
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 22_2_00007FFD347F1038	22_2_00007FFD347F1038
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 23_2_00007FFD348012F8	23_2_00007FFD348012F8
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 23_2_00007FFD34801719	23_2_00007FFD34801719
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 23_2_00007FFD348020F5	23_2_00007FFD348020F5
Source: C:\Users\user\AppData\Roaming\java.exe	Code function: 23_2_00007FFD34801038	23_2_00007FFD34801038

Source: file.exe, 00000000.00000000.2125500166.0000000000644000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamejava.exe4 vs file.exe
Source: file.exe, 00000000.00000002.3407281886.0000000000CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRemoteDesktop.dll< vs file.exe
Source: file.exe, 00000000.00000002.3408817500.0000000002A5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemoteDesktop.dll< vs file.exe
Source: file.exe, 00000000.00000002.3414135593.00000000129A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamejava.exe4 vs file.exe
Source: file.exe, 00000000.00000002.3408817500.0000000002A5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemoteDesktop.dll< vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamejava.exe4 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.file.exe.630000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.2125481379.0000000000632000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.3414135593.00000000129A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\java.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: file.exe, gGSik08LJTvBozHQW2rJNQsWdcNqnyZUe86p7yncuFlms6MojWQZlBOUXgyIdyiSbbkQtu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: file.exe, gGSik08LJTvBozHQW2rJNQsWdcNqnyZUe86p7yncuFlms6MojWQZlBOUXgyIdyiSbbkQtu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: file.exe, 775VniLT7bBOBCrgmDFH7fyve0dFdV6L3kiBaHDulpBhielIdxD38ipbQTK42LW6agwC07.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: java.exe.0.dr, gGSik08LJTvBozHQW2rJNQsWdcNqnyZUe86p7yncuFlms6MojWQZlBOUXgyIdyiSbbkQtu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: java.exe.0.dr, gGSik08LJTvBozHQW2rJNQsWdcNqnyZUe86p7yncuFlms6MojWQZlBOUXgyIdyiSbbkQtu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: java.exe.0.dr, 775VniLT7bBOBCrgmDFH7fyve0dFdV6L3kiBaHDulpBhielIdxD38ipbQTK42LW6agwC07.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.file.exe.ca0000.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.file.exe.ca0000.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.file.exe.2a61cd8.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.file.exe.2a61cd8.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: file.exe, l54gtFtLpKyOWZi2thKGa1BAbVNOqqAtAL11OEGAtZRsmPvwHpaf.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: file.exe, l54gtFtLpKyOWZi2thKGa1BAbVNOqqAtAL11OEGAtZRsmPvwHpaf.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: java.exe.0.dr, l54gtFtLpKyOWZi2thKGa1BAbVNOqqAtAL11OEGAtZRsmPvwHpaf.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: java.exe.0.dr, l54gtFtLpKyOWZi2thKGa1BAbVNOqqAtAL11OEGAtZRsmPvwHpaf.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/25@1/3

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\java.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6648:120:WilError_03
Source: C:\Users\user\AppData\Roaming\java.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4396:120:WilError_03
Source: C:\Users\user\Desktop\file.exe	Mutant created: \Sessions\1\BaseNamedObjects\mei9G7f5idjyuPFm

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\Log.tmp

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: file.exe

ReversingLabs: Detection: 81%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\file.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'file.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\java.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'java.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "java" /tr "C:\Users\user\AppData\Roaming\java.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\java.exe C:\Users\user\AppData\Roaming\java.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\java.exe "C:\Users\user\AppData\Roaming\java.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\java.exe "C:\Users\user\AppData\Roaming\java.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\java.exe C:\Users\user\AppData\Roaming\java.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\file.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'file.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\java.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'java.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "java" /tr "C:\Users\user\AppData\Roaming\java.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\java.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: java.lnk.0.dr

LNK file: ..\..\..\..\..\java.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: file.exe, IIZsOIHyVySFh0VVLDPW8E8jMSN60EFJqf0X0fdB9CktI2DeQ6uM.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{nbzxY3Uee1CRyZ11XxamWnTTLz6Y4j0TflqJSCXvqjEHl6vKzRSt._4bsK7RucmrV6WdjtjwArUiADXQuweRfXmix2RxjDnCBmlPnc2qwJ,nbzxY3Uee1CRyZ11XxamWnTTLz6Y4j0TflqJSCXvqjEHl6vKzRSt.bcnnRDXz7xSOfGx7U70JmxYRijsQDOE5vDBiollclBFMPOXGlpbo,nbzxY3Uee1CRyZ11XxamWnTTLz6Y4j0TflqJSCXvqjEHl6vKzRSt.S2SNlsqEExtrK68xhuYoBGDuqP2MGB29k3cn5XU84AFDozqUw2pi,nbzxY3Uee1CRyZ11XxamWnTTLz6Y4j0TflqJSCXvqjEHl6vKzRSt.p6zwrAdeQTwpb5oxJvVBAmcxvdkXv4kG0yuV9gVsZm6cEKFxDfC7,gGSik08LJTvBozHQW2rJNQsWdcNqnyZUe86p7yncuFlms6MojWQZlBOUXgyIdyiSbbkQtu.KmhMex9YyAfS6AOatebnkcmwSCGWRPRS5Vvs3U6kARFb9SEd9bQob4QtxuBFATr5QsJevR()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: file.exe, IIZsOIHyVySFh0VVLDPW8E8jMSN60EFJqf0X0fdB9CktI2DeQ6uM.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{A3HWRwL0H2NapROTqK2qJIe9VzPlcadcnxDI3HdFEFlAr0VzMt9FI6qJMPpxLAH1uZ50QyVtXf09GrVimPpO[2],gGSik08LJTvBozHQW2rJNQsWdcNqnyZUe86p7yncuFlms6MojWQZlBOUXgyIdyiSbbkQtu.eZ2Yx9fmSDDM(Convert.FromBase64String(A3HWRwL0H2NapROTqK2qJIe9VzPlcadcnxDI3HdFEFlAr0VzMt9FI6qJMPpxLAH1uZ50QyVtXf09GrVimPpO[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: file.exe, IIZsOIHyVySFh0VVLDPW8E8jMSN60EFJqf0X0fdB9CktI2DeQ6uM.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { A3HWRwL0H2NapROTqK2qJIe9VzPlcadcnxDI3HdFEFlAr0VzMt9FI6qJMPpxLAH1uZ50QyVtXf09GrVimPpO[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: java.exe.0.dr, IIZsOIHyVySFh0VVLDPW8E8jMSN60EFJqf0X0fdB9CktI2DeQ6uM.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{nbzxY3Uee1CRyZ11XxamWnTTLz6Y4j0TflqJSCXvqjEHl6vKzRSt._4bsK7RucmrV6WdjtjwArUiADXQuweRfXmix2RxjDnCBmlPnc2qwJ,nbzxY3Uee1CRyZ11XxamWnTTLz6Y4j0TflqJSCXvqjEHl6vKzRSt.bcnnRDXz7xSOfGx7U70JmxYRijsQDOE5vDBiollclBFMPOXGlpbo,nbzxY3Uee1CRyZ11XxamWnTTLz6Y4j0TflqJSCXvqjEHl6vKzRSt.S2SNlsqEExtrK68xhuYoBGDuqP2MGB29k3cn5XU84AFDozqUw2pi,nbzxY3Uee1CRyZ11XxamWnTTLz6Y4j0TflqJSCXvqjEHl6vKzRSt.p6zwrAdeQTwpb5oxJvVBAmcxvdkXv4kG0yuV9gVsZm6cEKFxDfC7,gGSik08LJTvBozHQW2rJNQsWdcNqnyZUe86p7yncuFlms6MojWQZlBOUXgyIdyiSbbkQtu.KmhMex9YyAfS6AOatebnkcmwSCGWRPRS5Vvs3U6kARFb9SEd9bQob4QtxuBFATr5QsJevR()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: java.exe.0.dr, IIZsOIHyVySFh0VVLDPW8E8jMSN60EFJqf0X0fdB9CktI2DeQ6uM.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{A3HWRwL0H2NapROTqK2qJIe9VzPlcadcnxDI3HdFEFlAr0VzMt9FI6qJMPpxLAH1uZ50QyVtXf09GrVimPpO[2],gGSik08LJTvBozHQW2rJNQsWdcNqnyZUe86p7yncuFlms6MojWQZlBOUXgyIdyiSbbkQtu.eZ2Yx9fmSDDM(Convert.FromBase64String(A3HWRwL0H2NapROTqK2qJIe9VzPlcadcnxDI3HdFEFlAr0VzMt9FI6qJMPpxLAH1uZ50QyVtXf09GrVimPpO[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: java.exe.0.dr, IIZsOIHyVySFh0VVLDPW8E8jMSN60EFJqf0X0fdB9CktI2DeQ6uM.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { A3HWRwL0H2NapROTqK2qJIe9VzPlcadcnxDI3HdFEFlAr0VzMt9FI6qJMPpxLAH1uZ50QyVtXf09GrVimPpO[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: file.exe, IIZsOIHyVySFh0VVLDPW8E8jMSN60EFJqf0X0fdB9CktI2DeQ6uM.cs	.Net Code: zKibE8Wp88nxv8n04w3dl7pqOhYe8zG2ETm6CSgSWwRc4QaAlpbO System.AppDomain.Load(byte[])
Source: file.exe, IIZsOIHyVySFh0VVLDPW8E8jMSN60EFJqf0X0fdB9CktI2DeQ6uM.cs	.Net Code: OxHZIE96j55IehWMppetm8WVRS4m4tGK85OOAGRDKqDyMnsUL0Z30ny0hn5ZG8yihFDgHC08iiyOAAah64X5 System.AppDomain.Load(byte[])
Source: file.exe, IIZsOIHyVySFh0VVLDPW8E8jMSN60EFJqf0X0fdB9CktI2DeQ6uM.cs	.Net Code: OxHZIE96j55IehWMppetm8WVRS4m4tGK85OOAGRDKqDyMnsUL0Z30ny0hn5ZG8yihFDgHC08iiyOAAah64X5
Source: java.exe.0.dr, IIZsOIHyVySFh0VVLDPW8E8jMSN60EFJqf0X0fdB9CktI2DeQ6uM.cs	.Net Code: zKibE8Wp88nxv8n04w3dl7pqOhYe8zG2ETm6CSgSWwRc4QaAlpbO System.AppDomain.Load(byte[])
Source: java.exe.0.dr, IIZsOIHyVySFh0VVLDPW8E8jMSN60EFJqf0X0fdB9CktI2DeQ6uM.cs	.Net Code: OxHZIE96j55IehWMppetm8WVRS4m4tGK85OOAGRDKqDyMnsUL0Z30ny0hn5ZG8yihFDgHC08iiyOAAah64X5 System.AppDomain.Load(byte[])
Source: java.exe.0.dr, IIZsOIHyVySFh0VVLDPW8E8jMSN60EFJqf0X0fdB9CktI2DeQ6uM.cs	.Net Code: OxHZIE96j55IehWMppetm8WVRS4m4tGK85OOAGRDKqDyMnsUL0Z30ny0hn5ZG8yihFDgHC08iiyOAAah64X5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD34825830 push esp; retf	0_2_00007FFD34825939
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD34819AF2 push 8B48FFFFh; retf	0_2_00007FFD34819AF7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD346ED2A5 pushad ; iretd	2_2_00007FFD346ED2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD346DD2A5 pushad ; iretd	6_2_00007FFD346DD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD3470D2A5 pushad ; iretd	10_2_00007FFD3470D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD348F2A60 pushad ; ret	10_2_00007FFD348F2A61
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FFD346FD2A5 pushad ; iretd	16_2_00007FFD346FD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FFD3481BC9D push E859A9D5h; ret	16_2_00007FFD3481BCF9

Source: file.exe, M3ptmYTEMWAB.cs	High entropy of concatenated method names: 'gp0YsiynZN2g', 'ZJeDT3GM4FAI', '_7RXI3dHEz7cY', 'jwSgEdSdtxBDkHM8doDYT2bm5wCvFBHIdV2xbZ9TQjsw', 'jrJxF4cshpRI5Jun2fE5xY8S6QQAHqcQU11Dqxol8Wwf', 'wUzLfYEtJE2o8tmDDRhMKhyfIIn3zHpzATS9GY44DThY', '_6X5HbTHT6YTncQjrKAJT7QY1YlQ5kWZEVcl1OkUmmjrb', 's3BR8naHMaxJjtvjNvTB2fpMnGdxdr0REsW5sCeIr2ik', 'b4h4aINGFxClKY152GZbLLHupdHRclxMmM9S8qiHd6H3', 'WpGAqzJgyR8tM5zIqHl2NFbB8nT1hupH2mZtYTt00XTT'
Source: file.exe, oUSjexChAppVeZ0ssdAFPwDkWXxbab01CmKmwzOxDTQlROrDuiAXIY2FlLivid05l5gtq3bsePKqC8j1SD69.cs	High entropy of concatenated method names: 'eoIbG65tXTLI1ovgnEYFVlPFGOxpb7IyOBvRHsYTcyoFep1lotqAP6nJQx9pYEjusVXbqUYKFfHMenpI6vj7', 'vwbRRbp0DPbuNeBPC6SJVcHxG74TUCpFzBwNBpvmM1H9i2KpusikL3PDc5G9gVwn4VdRGyJ4fwtuD6YrJKeG', 'PH3IN4pJQQEwMJwsgExia9LLbq8hQf2Iitut38JpCaXP9HaDNATxVUsVntMSUhEWToHt6F7uZYsmxUrqX9QE', 'FsjMtX6CksBD2fQTbpR0J456l0kFaBaTWqlWtDJWiQRgUsgQgE7P9Ez95OhGBYKB2PGKyp5JMZPScEOULCTS', 'QRscHXwe6naR533Itv72zUYuxOYGrl2X10cDAlSml7MhhijZDK4F1rZa6pHS0WuH4F5hX7o32WfGjxnqreY0', '_37nVgjyftjav8fqppob1umrDaEEXTt6GZaMeVC9eFlAxfdt1kshibFSjaHkP514cLlQQY6AxxrPuxEFR23R0', 'CXpwLISPdlzvt4WhUoQJdfnjEXHAzgILstaFvcPLRZ5sRF9rlQ7caHAkWnvXezskl7YKaE', 'zUgsPnV0pMXQQYBPlYTY9vcydeeLOQZ8T0BTRWzjPKDj24S4kC9eryHJj0FZkof8Br2SeG', 'giWTIEtPY6s2TTMdElhcIfHznwL2iB3SIG6FnQnUgJNbkOcZWVp2w4av34TF3TzyW1xmVe', 'Kj9AsEKucDvkEFi3gLYQ99e0qUwbF4IVYNf1edNU5TIRYjVIcAN7xXF3ASiM0w3IzKwNNK'
Source: file.exe, Y8h7ekJtf53H0CKI3TPYR0r2hfbocajvKPfw7qmK0mHFfSEcPGyNpfuNYvlDLId5P2lOvgFAbFGDEZNnyBYT.cs	High entropy of concatenated method names: 'adu2aADrBuccvNNVVqSYZvpM0CI2bK65BDDOkJuGc5u5TETvDmdYiD3dcJK1VjB7LJ62egwZ8d9nxOnH5P6I', 'DbokZYNxK5jo', 'zL0WYwWebm6Q', 'zpZDpsxeCjZN', 'hP7bv425jNx5'
Source: file.exe, DljV7yiUkhCKNzMv1XVMfbgUlqgzoInv7AwX78o2Ex4GkkReKlme.cs	High entropy of concatenated method names: 'jAq1IF3ddT6yLauHMQ9ulW51GahEKkZAp4wltElr9cQr5An5kUG9', '_9dEOpkJ3Dq8oShOesEd8DvQBAmaB11hTtRYMZX6Qm85LOYtDQ7i0', 'ap5p6bw8wLI8kV5xzdq6OYf49TXs5f2suYKNxw72BJuNp8kVjt4B', 'Jwk1cSMp1N9sOoPX59MQWyTdK2nsCi7UQAkeAqrfQ0BMeG1DQYTi', 'cdArGSxxIWGJLRYD0ScTXdLdPOhKxFZkewXOJRCFXcXKGZyER9bi', 'XiI0IghF6vkESZYqvtufVUoxLSa0pIYGT7MFefCGPL4pHTip8mu5', 'EoTFQxammhuLUBJkjVlCLWt65An0Iq7bvsl1Gl2Jd8rl6e9HuLg8', '_0qMZZNLpRow6uB439hJQ6N1EIVRFUcH8xsu70SXMQQ9RetyY9xEp', 'VQ7oGuif7XZxSBgryQEvLrLklrrx0aFadkeXNgEHbfOHizH7fCgW', 'f8pAdl1TaVWhlXDJZAcYACtV8KE9H2PQ7ePcEq9Zz7NFywyIHVnJ'
Source: file.exe, TnkVrkY3pzpsXLvpbg5h5iy5VedjuwVFGSS6BCERLvB8fB5fbBpZFY98GKSp1zkmVAig0QbcPhKpZOpXoewG.cs	High entropy of concatenated method names: 'lxsRUalp7Sg5NhoGnEPHunq7XaYydqXMfFzAsCoIPDCzcrBEiEa4VNxrpAbMhXtEp2BOgvWkXKVnHNdlNRI1', 'SbUogYgk7G6CW6vGOrYzdCjVbMnhnLCzT3u5RU7ibqiSWQHTB98jA4jou9LEaNOHevryJspyWJqcpPl2lFNb', 'yY9DHJDJQDPXjZOYzR2Owk5tEhhjovURDE47VcpN25uQPhYERvrpwl3aXbgsSlaatGRlNT5LXdH98l2Azuoh', 'GjyMXiI0TqDZ', '_5pe4xfICrp8h', 'AbR7Qp6SydzU', '_4zkxFCAzc82D', 'F62mTq12pG2X', 'nKMUxWyYhUK9', 'CgofFNSWMm9s'
Source: file.exe, IIZsOIHyVySFh0VVLDPW8E8jMSN60EFJqf0X0fdB9CktI2DeQ6uM.cs	High entropy of concatenated method names: 'IHQS8QYOd9moTDSEanN1sjHTnpWeVVazAJmyR9eXcJg22lwl2vE8', 'zKibE8Wp88nxv8n04w3dl7pqOhYe8zG2ETm6CSgSWwRc4QaAlpbO', 'cNG5tRkwJTR1ownoIngSH7wBj8bt7IRyOUY9vaZXQLTuS2bXnPHQ', 'Br5UcZpabKJNZniYHTkCKnrvNKecH9pu1ObE2kgcIm0LwOIZstUm', '_1XkoJBGYXI6Z5TAuHXWFwe05mpfAG86pKq3f5qWypCZiKa9AKaOA', 'wys04OiEHyhSCtRbRseGjbugPF7ntCeFw0li8k7sJRhikp9BNBhpjMvIueNt5OPD1TdzFUfdv7X9kSAsiTRr', '_8gJipHAkBOqFIWaBgGBlKaW0AmEicjychUwFToOPojJWifOGQkH8S8Eg8nKD1zbCIJztDwru95y4B72UbmvO', '_2rbEPVG6nb4uL4UdI1gmoLv4qa8i3dmTxMOrxQTkScGFm6UmrRsQRMlUmzj8kSrxqjNEjzS0slfXAFfWWwcn', 'uL1DwVlYMUkTdnhwnmAnaqk0tt6mayGu1ElOOdpSpuRwHa7BetGSQvHbsyH7BnrCgRzM8tAhbcAEMZzSZgbV', 'Fa7heNWSiOMFvASfglCx9UqGjkwzm7pMdqK9RS7xVOCZbiMmKjab3hMRz0tT792MRNSD7TJ5EiEAOwT3ZpIn'
Source: file.exe, gGSik08LJTvBozHQW2rJNQsWdcNqnyZUe86p7yncuFlms6MojWQZlBOUXgyIdyiSbbkQtu.cs	High entropy of concatenated method names: '_0sZQYedQljFSbXXuOyuPxQdGKQELj0m0REObc239KzIUZYGFf8ji5CEhsB9mIjAddO3ohy', 'BoHDOoCcD96rKe1oXlAqYjRFAk0e6ec6EPHPZRhV0073w7ZsAmJ344EEwcvWomFToSvgGQ', 'GpBfp25jiKTpysZ8XZxqlnl6JGyhJouJZxiVO27sSSfNWyWreFw1TGubxx0XPZiuVqxIVw', 'TStr6eh2tebBwJcgyoRwvx7j2JeAoS8V2KRIGrRtfb2mBuegLPYnVhtGR8aR7xSVZedbu3', 'H4XDsSzLbdVnNJNuAicSH4sSiDVURiJiznnTy4I7V6d2QlycoWNrnMXzFIqGohSlLouYBl', 'hVsQkBRc0RNdXppjpR6d5e7aV8pXHXKLMIhwTZN0nP6m9Kq4KEwRLaKrf7n4Vig6INZC3A', 'BXnUn5K2xegL2grzQdkWolfQgjEcKm5rIyJ1CTbA4INmuTpelc6uihWmvOSKEHg9V1emDt', 'hrQJ8hfahL8zJzaOiYNo1ikssYmRGBdaX2uXlntMxnrjvOME4uj4qAqywRiqcCT5LPdKmh', 'Id2EO9nStfroOxv9GFmQk4t4x3K2Na4glKwMgpE7ebwcj54DStsQRul4M5E6PdMMt5fXl8', 'BxXFvzqTQ3Pkl8o8oA2wA3Ullqj3oMLgFJwMj8qcOWXModCyuxpSas54zQhD8pX2nztdKw'
Source: file.exe, Cqf5ySADqnBBZJSGBs6XL0JHhzclJSTcTFxQnT47pV9tLeSqr21xtsUx8EfmB3gZ47HrV3.cs	High entropy of concatenated method names: 'RqwE2GFuZfPUcJIcLBq3XX4TWcKN4NeBcC3owGqrsHgnPg8fcDMT2FTM9u1BPz1gWVKCDD', 'LwgBdoAJo6UU7T6dX82c19OKryiQHMZMkjG5iR5wKHkDuWH9J63uF0VR8pTKfHq0oHreUv', 'aHot2acFS5B8E3y8257ImU23ft1YZ14AKlcRbyr34qG9pMqHRLBWFYRSnBU33sxUNVLh2m', 'EY3Vih6tyin3ziN3AUFlzEoGl6pVfBhktI7RZapZwNVHIzaooGjR4CQwfclTcgNLdIfTNB', 'wf4G9slVDSMC', 'd4xfPfAvuBgg', 'MkVl2W4HuHga', 'vZnHyxzgm4el', 'zBnj4uHa8HGC', 'qSZb8axXCDZm'
Source: file.exe, 775VniLT7bBOBCrgmDFH7fyve0dFdV6L3kiBaHDulpBhielIdxD38ipbQTK42LW6agwC07.cs	High entropy of concatenated method names: 'T6K5wpb8o6jbbx1kRkiuj8cGRFvn9UfmJ2j1BgmUx0J2PCOR4qkwF26LHswdenuZ22A2Ht', '_55GbWsfTknBQ', 'lACv4mMLFCLy', 'RJcVX7XqfS8N', 'zsv7fUUItM9C'
Source: file.exe, l54gtFtLpKyOWZi2thKGa1BAbVNOqqAtAL11OEGAtZRsmPvwHpaf.cs	High entropy of concatenated method names: 'ytTJeaHBMZWBiKLPVFx3poRI0l1uJwq0MUUgA8FLnqh9ETdaW7FY', 'Jx1mjn7Ud3qlURoYy7Sl2fJeczHcya1KYR2LGeW7CWXovlBOm4Rq', 'sHt8heCBFmzo5DkswFX462I6hvwWcUBpif9DL5l4kfjgbAUiV2RT', 'kBG0UhwPFOGO8FOQQ5cnkUwRUOpIylq2KodeXX1X1VG5SSnQzKhF', 'jlZa1r2qdPhVrr8uGw7G0ujhhNuI1BVuAtn25R3MKoupMxAMYEGP', 'Z1fBvyDWNF6wNdzBrOYiHjiStu6o0p6NHe7zx88ogEZrkG1Emunx', 'fINzRsqpdNko3zAGgDDZSjwe7f9smxUwQTeLosUKDlP6RlkjEy7u', 'QhsO9etZ7leq4WlTrjoU9HrouhZrSiUdFfehMlFa1nsAfjD72vWy', 'JvH9qnWkWtw7IA4fjdNRFNhtCcOyxZJE9qLaM3VnZaxk7BwUOvc6', 'uVyEk9STM7Rev1s2XkUokUU0nRPcC2LphqvF5v8wTU4wjcWcH5zy'
Source: java.exe.0.dr, M3ptmYTEMWAB.cs	High entropy of concatenated method names: 'gp0YsiynZN2g', 'ZJeDT3GM4FAI', '_7RXI3dHEz7cY', 'jwSgEdSdtxBDkHM8doDYT2bm5wCvFBHIdV2xbZ9TQjsw', 'jrJxF4cshpRI5Jun2fE5xY8S6QQAHqcQU11Dqxol8Wwf', 'wUzLfYEtJE2o8tmDDRhMKhyfIIn3zHpzATS9GY44DThY', '_6X5HbTHT6YTncQjrKAJT7QY1YlQ5kWZEVcl1OkUmmjrb', 's3BR8naHMaxJjtvjNvTB2fpMnGdxdr0REsW5sCeIr2ik', 'b4h4aINGFxClKY152GZbLLHupdHRclxMmM9S8qiHd6H3', 'WpGAqzJgyR8tM5zIqHl2NFbB8nT1hupH2mZtYTt00XTT'
Source: java.exe.0.dr, oUSjexChAppVeZ0ssdAFPwDkWXxbab01CmKmwzOxDTQlROrDuiAXIY2FlLivid05l5gtq3bsePKqC8j1SD69.cs	High entropy of concatenated method names: 'eoIbG65tXTLI1ovgnEYFVlPFGOxpb7IyOBvRHsYTcyoFep1lotqAP6nJQx9pYEjusVXbqUYKFfHMenpI6vj7', 'vwbRRbp0DPbuNeBPC6SJVcHxG74TUCpFzBwNBpvmM1H9i2KpusikL3PDc5G9gVwn4VdRGyJ4fwtuD6YrJKeG', 'PH3IN4pJQQEwMJwsgExia9LLbq8hQf2Iitut38JpCaXP9HaDNATxVUsVntMSUhEWToHt6F7uZYsmxUrqX9QE', 'FsjMtX6CksBD2fQTbpR0J456l0kFaBaTWqlWtDJWiQRgUsgQgE7P9Ez95OhGBYKB2PGKyp5JMZPScEOULCTS', 'QRscHXwe6naR533Itv72zUYuxOYGrl2X10cDAlSml7MhhijZDK4F1rZa6pHS0WuH4F5hX7o32WfGjxnqreY0', '_37nVgjyftjav8fqppob1umrDaEEXTt6GZaMeVC9eFlAxfdt1kshibFSjaHkP514cLlQQY6AxxrPuxEFR23R0', 'CXpwLISPdlzvt4WhUoQJdfnjEXHAzgILstaFvcPLRZ5sRF9rlQ7caHAkWnvXezskl7YKaE', 'zUgsPnV0pMXQQYBPlYTY9vcydeeLOQZ8T0BTRWzjPKDj24S4kC9eryHJj0FZkof8Br2SeG', 'giWTIEtPY6s2TTMdElhcIfHznwL2iB3SIG6FnQnUgJNbkOcZWVp2w4av34TF3TzyW1xmVe', 'Kj9AsEKucDvkEFi3gLYQ99e0qUwbF4IVYNf1edNU5TIRYjVIcAN7xXF3ASiM0w3IzKwNNK'
Source: java.exe.0.dr, Y8h7ekJtf53H0CKI3TPYR0r2hfbocajvKPfw7qmK0mHFfSEcPGyNpfuNYvlDLId5P2lOvgFAbFGDEZNnyBYT.cs	High entropy of concatenated method names: 'adu2aADrBuccvNNVVqSYZvpM0CI2bK65BDDOkJuGc5u5TETvDmdYiD3dcJK1VjB7LJ62egwZ8d9nxOnH5P6I', 'DbokZYNxK5jo', 'zL0WYwWebm6Q', 'zpZDpsxeCjZN', 'hP7bv425jNx5'
Source: java.exe.0.dr, DljV7yiUkhCKNzMv1XVMfbgUlqgzoInv7AwX78o2Ex4GkkReKlme.cs	High entropy of concatenated method names: 'jAq1IF3ddT6yLauHMQ9ulW51GahEKkZAp4wltElr9cQr5An5kUG9', '_9dEOpkJ3Dq8oShOesEd8DvQBAmaB11hTtRYMZX6Qm85LOYtDQ7i0', 'ap5p6bw8wLI8kV5xzdq6OYf49TXs5f2suYKNxw72BJuNp8kVjt4B', 'Jwk1cSMp1N9sOoPX59MQWyTdK2nsCi7UQAkeAqrfQ0BMeG1DQYTi', 'cdArGSxxIWGJLRYD0ScTXdLdPOhKxFZkewXOJRCFXcXKGZyER9bi', 'XiI0IghF6vkESZYqvtufVUoxLSa0pIYGT7MFefCGPL4pHTip8mu5', 'EoTFQxammhuLUBJkjVlCLWt65An0Iq7bvsl1Gl2Jd8rl6e9HuLg8', '_0qMZZNLpRow6uB439hJQ6N1EIVRFUcH8xsu70SXMQQ9RetyY9xEp', 'VQ7oGuif7XZxSBgryQEvLrLklrrx0aFadkeXNgEHbfOHizH7fCgW', 'f8pAdl1TaVWhlXDJZAcYACtV8KE9H2PQ7ePcEq9Zz7NFywyIHVnJ'
Source: java.exe.0.dr, TnkVrkY3pzpsXLvpbg5h5iy5VedjuwVFGSS6BCERLvB8fB5fbBpZFY98GKSp1zkmVAig0QbcPhKpZOpXoewG.cs	High entropy of concatenated method names: 'lxsRUalp7Sg5NhoGnEPHunq7XaYydqXMfFzAsCoIPDCzcrBEiEa4VNxrpAbMhXtEp2BOgvWkXKVnHNdlNRI1', 'SbUogYgk7G6CW6vGOrYzdCjVbMnhnLCzT3u5RU7ibqiSWQHTB98jA4jou9LEaNOHevryJspyWJqcpPl2lFNb', 'yY9DHJDJQDPXjZOYzR2Owk5tEhhjovURDE47VcpN25uQPhYERvrpwl3aXbgsSlaatGRlNT5LXdH98l2Azuoh', 'GjyMXiI0TqDZ', '_5pe4xfICrp8h', 'AbR7Qp6SydzU', '_4zkxFCAzc82D', 'F62mTq12pG2X', 'nKMUxWyYhUK9', 'CgofFNSWMm9s'
Source: java.exe.0.dr, IIZsOIHyVySFh0VVLDPW8E8jMSN60EFJqf0X0fdB9CktI2DeQ6uM.cs	High entropy of concatenated method names: 'IHQS8QYOd9moTDSEanN1sjHTnpWeVVazAJmyR9eXcJg22lwl2vE8', 'zKibE8Wp88nxv8n04w3dl7pqOhYe8zG2ETm6CSgSWwRc4QaAlpbO', 'cNG5tRkwJTR1ownoIngSH7wBj8bt7IRyOUY9vaZXQLTuS2bXnPHQ', 'Br5UcZpabKJNZniYHTkCKnrvNKecH9pu1ObE2kgcIm0LwOIZstUm', '_1XkoJBGYXI6Z5TAuHXWFwe05mpfAG86pKq3f5qWypCZiKa9AKaOA', 'wys04OiEHyhSCtRbRseGjbugPF7ntCeFw0li8k7sJRhikp9BNBhpjMvIueNt5OPD1TdzFUfdv7X9kSAsiTRr', '_8gJipHAkBOqFIWaBgGBlKaW0AmEicjychUwFToOPojJWifOGQkH8S8Eg8nKD1zbCIJztDwru95y4B72UbmvO', '_2rbEPVG6nb4uL4UdI1gmoLv4qa8i3dmTxMOrxQTkScGFm6UmrRsQRMlUmzj8kSrxqjNEjzS0slfXAFfWWwcn', 'uL1DwVlYMUkTdnhwnmAnaqk0tt6mayGu1ElOOdpSpuRwHa7BetGSQvHbsyH7BnrCgRzM8tAhbcAEMZzSZgbV', 'Fa7heNWSiOMFvASfglCx9UqGjkwzm7pMdqK9RS7xVOCZbiMmKjab3hMRz0tT792MRNSD7TJ5EiEAOwT3ZpIn'
Source: java.exe.0.dr, gGSik08LJTvBozHQW2rJNQsWdcNqnyZUe86p7yncuFlms6MojWQZlBOUXgyIdyiSbbkQtu.cs	High entropy of concatenated method names: '_0sZQYedQljFSbXXuOyuPxQdGKQELj0m0REObc239KzIUZYGFf8ji5CEhsB9mIjAddO3ohy', 'BoHDOoCcD96rKe1oXlAqYjRFAk0e6ec6EPHPZRhV0073w7ZsAmJ344EEwcvWomFToSvgGQ', 'GpBfp25jiKTpysZ8XZxqlnl6JGyhJouJZxiVO27sSSfNWyWreFw1TGubxx0XPZiuVqxIVw', 'TStr6eh2tebBwJcgyoRwvx7j2JeAoS8V2KRIGrRtfb2mBuegLPYnVhtGR8aR7xSVZedbu3', 'H4XDsSzLbdVnNJNuAicSH4sSiDVURiJiznnTy4I7V6d2QlycoWNrnMXzFIqGohSlLouYBl', 'hVsQkBRc0RNdXppjpR6d5e7aV8pXHXKLMIhwTZN0nP6m9Kq4KEwRLaKrf7n4Vig6INZC3A', 'BXnUn5K2xegL2grzQdkWolfQgjEcKm5rIyJ1CTbA4INmuTpelc6uihWmvOSKEHg9V1emDt', 'hrQJ8hfahL8zJzaOiYNo1ikssYmRGBdaX2uXlntMxnrjvOME4uj4qAqywRiqcCT5LPdKmh', 'Id2EO9nStfroOxv9GFmQk4t4x3K2Na4glKwMgpE7ebwcj54DStsQRul4M5E6PdMMt5fXl8', 'BxXFvzqTQ3Pkl8o8oA2wA3Ullqj3oMLgFJwMj8qcOWXModCyuxpSas54zQhD8pX2nztdKw'
Source: java.exe.0.dr, Cqf5ySADqnBBZJSGBs6XL0JHhzclJSTcTFxQnT47pV9tLeSqr21xtsUx8EfmB3gZ47HrV3.cs	High entropy of concatenated method names: 'RqwE2GFuZfPUcJIcLBq3XX4TWcKN4NeBcC3owGqrsHgnPg8fcDMT2FTM9u1BPz1gWVKCDD', 'LwgBdoAJo6UU7T6dX82c19OKryiQHMZMkjG5iR5wKHkDuWH9J63uF0VR8pTKfHq0oHreUv', 'aHot2acFS5B8E3y8257ImU23ft1YZ14AKlcRbyr34qG9pMqHRLBWFYRSnBU33sxUNVLh2m', 'EY3Vih6tyin3ziN3AUFlzEoGl6pVfBhktI7RZapZwNVHIzaooGjR4CQwfclTcgNLdIfTNB', 'wf4G9slVDSMC', 'd4xfPfAvuBgg', 'MkVl2W4HuHga', 'vZnHyxzgm4el', 'zBnj4uHa8HGC', 'qSZb8axXCDZm'
Source: java.exe.0.dr, 775VniLT7bBOBCrgmDFH7fyve0dFdV6L3kiBaHDulpBhielIdxD38ipbQTK42LW6agwC07.cs	High entropy of concatenated method names: 'T6K5wpb8o6jbbx1kRkiuj8cGRFvn9UfmJ2j1BgmUx0J2PCOR4qkwF26LHswdenuZ22A2Ht', '_55GbWsfTknBQ', 'lACv4mMLFCLy', 'RJcVX7XqfS8N', 'zsv7fUUItM9C'
Source: java.exe.0.dr, l54gtFtLpKyOWZi2thKGa1BAbVNOqqAtAL11OEGAtZRsmPvwHpaf.cs	High entropy of concatenated method names: 'ytTJeaHBMZWBiKLPVFx3poRI0l1uJwq0MUUgA8FLnqh9ETdaW7FY', 'Jx1mjn7Ud3qlURoYy7Sl2fJeczHcya1KYR2LGeW7CWXovlBOm4Rq', 'sHt8heCBFmzo5DkswFX462I6hvwWcUBpif9DL5l4kfjgbAUiV2RT', 'kBG0UhwPFOGO8FOQQ5cnkUwRUOpIylq2KodeXX1X1VG5SSnQzKhF', 'jlZa1r2qdPhVrr8uGw7G0ujhhNuI1BVuAtn25R3MKoupMxAMYEGP', 'Z1fBvyDWNF6wNdzBrOYiHjiStu6o0p6NHe7zx88ogEZrkG1Emunx', 'fINzRsqpdNko3zAGgDDZSjwe7f9smxUwQTeLosUKDlP6RlkjEy7u', 'QhsO9etZ7leq4WlTrjoU9HrouhZrSiUdFfehMlFa1nsAfjD72vWy', 'JvH9qnWkWtw7IA4fjdNRFNhtCcOyxZJE9qLaM3VnZaxk7BwUOvc6', 'uVyEk9STM7Rev1s2XkUokUU0nRPcC2LphqvF5v8wTU4wjcWcH5zy'

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\java.exe

Jump to dropped file

Boot Survival

Creates autostart registry keys to launch java

Source: C:\Users\user\Desktop\file.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run java C:\Users\user\AppData\Roaming\java.exe

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "java" /tr "C:\Users\user\AppData\Roaming\java.exe"

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\java.lnk

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\java.lnk

Loading BitLocker PowerShell Module

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run java			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run java			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\file.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\F6B74C14BDC1CCC7FF6E 88D9A666AFE4B49FD15B45F1DC568347855CF049E54918D00BAF1610AE750872

Check if machine is in data center or colocation facility

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\java.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, java.exe.0.dr

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\file.exe	Memory allocated: C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 1A990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\java.exe	Memory allocated: A40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\java.exe	Memory allocated: 1A610000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\java.exe	Memory allocated: 1030000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\java.exe	Memory allocated: 1ADE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\java.exe	Memory allocated: 840000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\java.exe	Memory allocated: 1A2E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\java.exe	Memory allocated: E50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\java.exe	Memory allocated: 1A9C0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\java.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\java.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\java.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\java.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 766	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 9081	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6041	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3751	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7809	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1689	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5819	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3774	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7064
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2471

Source: C:\Users\user\Desktop\file.exe TID: 1016	Thread sleep time: -35971150943733603s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3404	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5260	Thread sleep count: 7809 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1016	Thread sleep count: 1689 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5648	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6532	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 380	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 880	Thread sleep count: 7064 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4436	Thread sleep count: 2471 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6748	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Users\user\AppData\Roaming\java.exe TID: 5768	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\java.exe TID: 6780	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\java.exe TID: 1112	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\java.exe TID: 4892	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\java.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\java.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\java.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\java.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\java.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\java.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\java.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\java.exe	Thread delayed: delay time: 922337203685477

Source: java.exe.0.dr	Binary or memory string: vmware
Source: svchost.exe, 0000000C.00000002.3404879630.0000014D50A54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3403481208.0000014D4B42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.3417338709.000000001B833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllBB

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Anti Debugging

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FFD34817A8B CheckRemoteDebuggerPresent,

0_2_00007FFD34817A8B

Source: C:\Users\user\Desktop\file.exe

Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\java.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\java.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\file.exe'
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\java.exe'
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\file.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\java.exe'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\file.exe'

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\file.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'file.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\java.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'java.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "java" /tr "C:\Users\user\AppData\Roaming\java.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\java.exe	Queries volume information: C:\Users\user\AppData\Roaming\java.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\java.exe	Queries volume information: C:\Users\user\AppData\Roaming\java.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\java.exe	Queries volume information: C:\Users\user\AppData\Roaming\java.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\java.exe	Queries volume information: C:\Users\user\AppData\Roaming\java.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: file.exe, 00000000.00000002.3417338709.000000001B8D1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.2.file.exe.2a61cd8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3408817500.0000000002991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2125481379.0000000000632000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3414135593.00000000129A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3408817500.0000000002A5F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2968, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\java.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.2.file.exe.2a61cd8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3408817500.0000000002991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2125481379.0000000000632000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3414135593.00000000129A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3408817500.0000000002A5F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2968, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\java.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	33 System Information Discovery	Remote Desktop Protocol	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	121 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Obfuscated Files or Information	Security Account Manager	441 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	121 Registry Run Keys / Startup Folder	2 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	61 Virtualization/Sandbox Evasion	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	61 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	82%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
file.exe	100%	Avira	TR/Spy.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\java.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\java.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\java.exe	82%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT

Source	Detection	Scanner	Label
http://crl.mwrr	0%	Avira URL Cloud	safe
103.230.121.124	0%	Avira URL Cloud	safe
http://www.microsof.	0%	Avira URL Cloud	safe
http://crl.mEk	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high
ax-0001.ax-msedge.net	150.171.28.10	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
103.230.121.124	true	Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2215164794.000001A95E38F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2344886418.00000283B7450000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2535136139.000001603D3E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2743903646.000001AA3758E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000010.00000002.2608646388.000001AA27748000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.2188717626.000001A94E548000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2258347917.00000283A7608000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410917342.000001602D599000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2608646388.000001AA27748000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000010.00000002.2608646388.000001AA27748000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.micom/pkiops/Docs/ry.htm0	powershell.exe, 0000000A.00000002.2565979792.00000160459C0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.co	powershell.exe, 0000000A.00000002.2565979792.00000160459C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000010.00000002.2743903646.000001AA3758E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mic	powershell.exe, 0000000A.00000002.2565979792.00000160459C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000010.00000002.2743903646.000001AA3758E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000C.00000003.2419893569.0000014D507F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.12.dr	false		high
http://crl.ver)	svchost.exe, 0000000C.00000002.3404757837.0000014D50A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.mwrr	powershell.exe, 00000010.00000002.2788544473.000001AA3FCE5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000010.00000002.2608646388.000001AA27748000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.12.dr	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.2188717626.000001A94E548000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2258347917.00000283A7608000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410917342.000001602D599000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2608646388.000001AA27748000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000010.00000002.2743903646.000001AA3758E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2215164794.000001A95E38F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2344886418.00000283B7450000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2535136139.000001603D3E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2743903646.000001AA3758E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.microsoft.c	powershell.exe, 00000010.00000002.2604852851.000001AA25B77000.00000004.00000020.00020000.00000000.sdmp	false		high
http://go.microsoft.ctain	powershell.exe, 00000010.00000002.2604852851.000001AA25B77000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsof.	powershell.exe, 0000000A.00000002.2565979792.00000160459C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micft.cMicRosof	powershell.exe, 0000000A.00000002.2565979792.00000160459C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2188717626.000001A94E321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2258347917.00000283A73E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410917342.000001602D371000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2608646388.000001AA27521000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.c	powershell.exe, 0000000A.00000002.2565979792.0000016045A79000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	file.exe, 00000000.00000002.3408817500.0000000002991000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2188717626.000001A94E321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2258347917.00000283A73E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410917342.000001602D371000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2608646388.000001AA27521000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mEk	powershell.exe, 0000000A.00000002.2565979792.00000160459C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
103.230.121.124	unknown	Hong Kong		62468	VPSQUANUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565291
Start date and time:	2024-11-29 15:18:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/25@1/3
EGA Information:	Successful, ratio: 11.1%
HCA Information:	Successful, ratio: 98% Number of executed functions: 128 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 2.23.161.164
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, tse1.mm.bing.net, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target java.exe, PID 3088 because it is empty
Execution Graph export aborted for target java.exe, PID 3428 because it is empty
Execution Graph export aborted for target java.exe, PID 6464 because it is empty
Execution Graph export aborted for target java.exe, PID 7016 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3360 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4512 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5932 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6116 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:18:59	API Interceptor	184x Sleep call for process: file.exe modified
09:19:02	API Interceptor	60x Sleep call for process: powershell.exe modified
09:19:28	API Interceptor	2x Sleep call for process: svchost.exe modified
09:20:09	API Interceptor	4x Sleep call for process: java.exe modified
15:20:09	Task Scheduler	Run new task: java path: C:\Users\user\AppData\Roaming\java.exe
15:20:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run java C:\Users\user\AppData\Roaming\java.exe
15:20:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run java C:\Users\user\AppData\Roaming\java.exe
15:20:26	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\java.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Enquiry.js	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	8FloezlGW7.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	ip-api.com/json/?fields=225545
	Orden de compra.pdf______________________________________.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Pedido_4502351226_de Compa#U00f1#U00eda Anno S.A..exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	word.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	svchost.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	Chrome.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	Registry.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	OC LICITACI#U00d3N DICIEMBRE_24.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	VzhY4BcvBH.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse	ip-api.com/line/?fields=hosting
103.230.121.124	word.exe	Get hash	malicious	XWorm	Browse
	svchost.exe	Get hash	malicious	XWorm	Browse
	Chrome.exe	Get hash	malicious	XWorm	Browse
	Registry.exe	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	Enquiry.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8FloezlGW7.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	208.95.112.1
	https://www.scrolldroll.com/best-dialogues-from-asur/	Get hash	malicious	Unknown	Browse	208.95.112.2
	Orden de compra.pdf______________________________________.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Pedido_4502351226_de Compa#U00f1#U00eda Anno S.A..exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	word.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	svchost.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Chrome.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Registry.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	OC LICITACI#U00d3N DICIEMBRE_24.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
ax-0001.ax-msedge.net	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim	Browse	150.171.28.10
	setup#U4f01#U4e1a#U540d#U5355.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://aysesuretobea.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Credential Flusher	Browse	150.171.27.10
	Scan_19112024_people_power_press.pdf	Get hash	malicious	Unknown	Browse	150.171.27.10
	CC_scan.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10
	22.exe	Get hash	malicious	Unknown	Browse	150.171.28.10
	No. I20220052.exe	Get hash	malicious	FormBook	Browse	150.171.27.10
	https://www.google.rs/url?q=160CHARtTPSJ3J3wDyycT&sa=t&esrc=TYsrCFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=HARlDJVS0YXpPkDfJ6C&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/aloperdehatti.com/on/wTARVgfa92/%61%6C%65%73%73%69%61%2E%64%61%6E%69%65%6C%65%40%74%6F%6E%69%6E%63%61%73%61%2E%69%74&ugs=n8CoFFz5hZ4Yaxn3ZJryvKlaQxQ-BOyvjZ0GlahI9shjnWfTZ1du_w==	Get hash	malicious	Unknown	Browse	150.171.27.10

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VPSQUANUS	word.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	svchost.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	Chrome.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	Registry.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	qkbfi86.elf	Get hash	malicious	Mirai	Browse	103.252.19.63
	amen.arm.elf	Get hash	malicious	Unknown	Browse	43.225.59.17
	AIYi17AyGz.exe	Get hash	malicious	Metasploit, Meterpreter	Browse	198.44.176.141
	o88dYvhfkt.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	156.224.21.148
	file.exe	Get hash	malicious	Sliver	Browse	198.44.168.104
	sBX8VM67ZE.exe	Get hash	malicious	FormBook	Browse	23.251.54.212
TUT-ASUS	Enquiry.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8FloezlGW7.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	208.95.112.1
	https://www.scrolldroll.com/best-dialogues-from-asur/	Get hash	malicious	Unknown	Browse	208.95.112.2
	Orden de compra.pdf______________________________________.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Pedido_4502351226_de Compa#U00f1#U00eda Anno S.A..exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	word.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	svchost.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Chrome.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Registry.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	OC LICITACI#U00d3N DICIEMBRE_24.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263175011378977
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0Z:9JZj5MiKNnNhoxuk
MD5:	FAA9F84C5D684D3E06B84FAB002F817D
SHA1:	BF1F8BDB002A1BD3431B351FE0A3F8EC8E772E9B
SHA-256:	C40BD5AAE054D17CE6F760B95F56C48A20B69A0BF18C5388FB762AE36ED6B7C5
SHA-512:	6B103B4EC0F6799160DA474C4D4BA4A0BF39566D12915D4083328BFA0A2D482195ABCDB81260FC8C28056028456B76DED26F8253710B0E4AA76BE2D92411D099
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xe3e9a350, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7556072070252107
Encrypted:	false
SSDEEP:	1536:tSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:tazaSvGJzYj2UlmOlOL
MD5:	EF48379D182646658C3C48EC7A03D37E
SHA1:	F3435C1178B13B0100DAC1A1CDDCF17AF76D50B4
SHA-256:	83C9CDCF6B0CC5133B7D4584698B85B98A1034B81370857B504540D65C549DB4
SHA-512:	A2B4EFCBE4B379F698ECC071FB914CF66A7A053EF4619DEE226D27C99D4FA8DDF80C2C82FD4DE797DD85DE5738C8AAE13078B8E1B5ACB24DB067026A566CB90D
Malicious:	false
Preview:	..P... .......7.......X\...;...{......................0.e......!...{?......\|..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................F7.......\|....................\......\|...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0795882601702125
Encrypted:	false
SSDEEP:	3:7Jml/yYeO8ANaAPaU1lBhMjAilluxmO+l/SNxOf:7ol6ztANDPaU0jVgmOH
MD5:	1901737C957717B61B9643E1F1803682
SHA1:	ED0E46891031D57CE36D77EA67AC5BD3C5F37C60
SHA-256:	158502733AA5B0FC68E3B052903552C942E45D5D6161E9BA818A25E7BDB97E32
SHA-512:	615E8E569AA861B3A58F9D6D988A3A2DE8EF84145FC67FFEE739EBB12CADD26BBB99CD22C51186F905032C09AADABBFE85E55D714917F6F9EBFD8089791EC618
Malicious:	false
Preview:	..#,.....................................;...{.......\|...!...{?..........!...{?..!...{?..g...!...{?...................\......\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\java.exe.log

Process:	C:\Users\user\AppData\Roaming\java.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\Log.tmp

Process:	C:\Users\user\Desktop\file.exe
File Type:	Generic INItialization configuration [WIN]
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.6722687970803873
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr42VjFYJKXzovuEXn:EFYJKDoWr5FYJKDoG+n
MD5:	DE63D53293EBACE29F3F54832D739D40
SHA1:	1BC3FEF699C3C2BB7B9A9D63C7E60381263EDA7F
SHA-256:	A86BA2FC02725E4D97799A622EB68BF2FCC6167D439484624FA2666468BBFB1B
SHA-512:	10AB83C81F572DBAA99441D2BFD8EC5FF1C4BA84256ACDBD24FEB30A33498B689713EBF767500DAAAD6D188A3B9DC970CF858A6896F4381CEAC1F6A74E1603D0
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]....### explorer ###..r[WIN]r

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1afmmfww.uii.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tqejovt.nfw.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_51nrh1b0.pbe.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a3gydb12.lr4.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b31nzd1r.jwm.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c4tv2cob.4bv.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d1yzdh0o.hiv.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ewkv1ffq.g1w.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ijx3yxm1.ayn.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iqwiwusx.uhg.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_izr3io0a.nmg.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kjbg4qw5.us3.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kuunladu.p12.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mnoywowf.xae.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwbb1kh5.chc.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ukndrinm.xhu.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\java.lnk

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Nov 29 13:20:08 2024, mtime=Fri Nov 29 13:20:08 2024, atime=Fri Nov 29 13:20:08 2024, length=89088, window=hide
Category:	dropped
Size (bytes):	750
Entropy (8bit):	5.050525353550501
Encrypted:	false
SSDEEP:	12:8iKlEO4AY0pnu8ChC4Tl8lXIsY//KCP3wJLd1A586EAjAsKllE+H8BUh+VpMV9mV:8i+mALD2l8lXUmFd1Z6bAsK/ENsA89m
MD5:	60671F02C3DDDF0BCE82CEEA7E672F9A
SHA1:	AF1ABABDF369A0C36879A04AC997C8EBA6B8B9DA
SHA-256:	1697488D5D15F6CB500474D006864B991A882F4EC4066F8091CDADA41616C056
SHA-512:	A275469EEBB1E7AEA3C621A48141104EE7FDDDF5DF33E51AF0CB4220778FCDAAEE73ABB7192AA5784532EFBE2E47EA38EBFB262E578C7541B51D27F6771EF9B2
Malicious:	false
Preview:	L..................F.... ...(...iB..(...iB..(...iB...\......................n.:..DG..Yr?.D..U..k0.&...&.......$..S...\..iB......iB......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2}Y]r...........................^.A.p.p.D.a.t.a...B.V.1.....}Y[r..Roaming.@......EW<2}Y[r..../.....................W...R.o.a.m.i.n.g.....Z.2..\..}Y.r .java.exe..B......}Y.r}Y.r............................0.j.a.v.a...e.x.e.......Y...............-.......X............_.......C:\Users\user\AppData\Roaming\java.exe........\.....\.....\.....\.....\.j.a.v.a...e.x.e.`.......X.......045012...........hT..CrF.f4... .\|...]....-...-$..hT..CrF.f4... .\|...]....-...-$.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\java.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	6.687051336040018
Encrypted:	false
SSDEEP:	1536:XT1opub0jX2VNjYsBabpfkT8Kjht6CvOjTd2ogBTR7IPxgW4hYxxBlzo:D1Auoj6dBwbpfkTttvOjYogBiPxJ4hc4
MD5:	4347FB3A5B1EABF2E594A895A30B98F4
SHA1:	36993DF090A7F68C57F96FFE5724674520998AC8
SHA-256:	492A7DE87F0FF73DA5B30A460CE1FBE03A0D7EDF0634906F6A67D711B4A46751
SHA-512:	7157339421E0E51B3F3FA2659C273B428D2E63207977C5F4145FBAABB9BA866D60F8DF290E29DC5D203D241497D1891EE7302A83F5C069D5BA29928736416E01
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\java.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\java.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\java.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C;g.....................L.......,... ...@....@.. ....................................@.................................d,..W....@...I........................................................................... ............... ..H............text........ ...................... ..`.rsrc....I...@...J..................@..@.reloc...............Z..............@..B.................,......H........n..\|.......&.....................................................(.....r...p. .W....(.....r...p. ....s.........s.........s.........s..........r5..p. .....rO..p. .....ri..p. ..e..r...p. .z...r...p. .5....((....r...p. S....r...p. P4...(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(Z..."(....+.&('...&+..+5sk... .... .'..ol...(,...~....-.(_...(Q...~....om...&.-..r...p. j....r...p. ..p..r...p. ..W..r...p. .....r1..p. .\=..rK..p. .x!.*.re.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.687051336040018
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	file.exe
File size:	89'088 bytes
MD5:	4347fb3a5b1eabf2e594a895a30b98f4
SHA1:	36993df090a7f68c57f96ffe5724674520998ac8
SHA256:	492a7de87f0ff73da5b30a460ce1fbe03a0d7edf0634906f6a67d711b4a46751
SHA512:	7157339421e0e51b3f3fa2659c273b428d2e63207977c5f4145fbaabb9ba866d60f8df290e29dc5d203d241497d1891ee7302a83f5c069d5ba29928736416e01
SSDEEP:	1536:XT1opub0jX2VNjYsBabpfkT8Kjht6CvOjTd2ogBTR7IPxgW4hYxxBlzo:D1Auoj6dBwbpfkTttvOjYogBiPxJ4hc4
TLSH:	E893AE9CB7D40561D1FF5BB568B23202CA74EA630E03D70F68C951DA6B2B68C8D40BF9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C;g.....................L.......,... ...@....@.. ....................................@................................

File Icon


Icon Hash:	901c8e4653435b79

Static PE Info

General

Entrypoint:	0x412cbe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x673B439B [Mon Nov 18 13:39:39 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12c64	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0x49d2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x10cc4	0x10e00	9a565d2d742f2cbc26acefad1e5a8dfb	False	0.5816116898148148	data	6.154683890959466	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x14000	0x49d2	0x4a00	c0d2a6732f0434ac63b5df3a6e7b062f	False	0.9642630912162162	data	7.883693475319175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	a5923cbf3cc95dc01c44e397433c2633	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x14130	0x4466	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	1.000913763563678
RT_GROUP_ICON	0x18598	0x14	data	0.9
RT_VERSION	0x185ac	0x23c	data	0.4737762237762238
RT_MANIFEST	0x187e8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-29T15:20:23.932978+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.6	49884	103.230.121.124	7000	TCP
2024-11-29T15:20:24.666364+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.6	49884	TCP
2024-11-29T15:20:24.694814+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49884	103.230.121.124	7000	TCP
2024-11-29T15:20:28.810945+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.6	49884	TCP
2024-11-29T15:20:28.810945+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	103.230.121.124	7000	192.168.2.6	49884	TCP
2024-11-29T15:20:35.564791+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.6	49884	TCP
2024-11-29T15:20:35.567275+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49884	103.230.121.124	7000	TCP
2024-11-29T15:20:46.628008+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.6	49884	TCP
2024-11-29T15:20:46.631035+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49884	103.230.121.124	7000	TCP
2024-11-29T15:20:57.689916+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.6	49884	TCP
2024-11-29T15:20:57.691756+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49884	103.230.121.124	7000	TCP
2024-11-29T15:20:58.593385+0100	2853192	ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound	1	192.168.2.6	49884	103.230.121.124	7000	TCP
2024-11-29T15:20:58.893906+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.6	49884	TCP
2024-11-29T15:20:58.893906+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	103.230.121.124	7000	192.168.2.6	49884	TCP
2024-11-29T15:20:59.340612+0100	2853191	ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound	1	103.230.121.124	7000	192.168.2.6	49884	TCP
2024-11-29T15:20:59.822140+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:20:59.822140+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:20:59.943490+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:20:59.943490+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:00.064973+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:00.064973+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:00.184921+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:00.184921+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:00.306110+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:00.306110+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:00.426980+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:00.426980+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:00.547220+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:00.547220+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:00.787599+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:00.787599+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:00.907672+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:00.907672+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:01.027780+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:01.027780+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:01.147964+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:01.147964+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:01.268067+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:01.268067+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:01.390386+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:01.390386+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:01.512111+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:01.512111+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:01.724011+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:01.724011+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:01.923266+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:01.923266+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:02.125543+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:02.125543+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:02.246667+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:02.246667+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:02.366715+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:02.366715+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:02.608571+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:02.608571+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:02.728572+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:02.728572+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:02.848703+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:02.848703+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:03.088530+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:03.088530+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:03.208751+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:03.208751+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:03.329282+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:03.329282+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:03.449996+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:03.449996+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:03.573360+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:03.573360+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:03.814592+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:03.814592+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:03.920478+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:03.920478+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:04.040774+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:04.040774+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:04.162284+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:04.162284+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:04.290201+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:04.290201+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:04.426020+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:04.426020+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:04.596157+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:04.596157+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:04.720026+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:04.720026+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:05.030145+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:05.030145+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:05.150189+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:05.150189+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:05.270211+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:05.270211+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:05.372291+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:05.372291+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:05.492173+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:05.492173+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:05.854165+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:05.854165+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:05.975522+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:05.975522+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.029420+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.029420+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.149596+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.149596+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.269661+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.269661+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.389848+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.389848+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.510254+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.510254+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.630516+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.630516+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.712689+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.712689+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.832827+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.832827+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.952909+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:06.952909+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:07.073227+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:07.073227+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:07.193395+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:07.193395+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:07.313717+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:07.313717+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:07.420599+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:07.420599+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:07.540909+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:07.540909+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49986	103.230.121.124	7000	TCP
2024-11-29T15:21:10.865014+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.6	49884	TCP
2024-11-29T15:21:10.866269+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49884	103.230.121.124	7000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 15:19:00.984755993 CET	49712	80	192.168.2.6	208.95.112.1
Nov 29, 2024 15:19:01.105110884 CET	80	49712	208.95.112.1	192.168.2.6
Nov 29, 2024 15:19:01.105212927 CET	49712	80	192.168.2.6	208.95.112.1
Nov 29, 2024 15:19:01.105918884 CET	49712	80	192.168.2.6	208.95.112.1
Nov 29, 2024 15:19:01.225871086 CET	80	49712	208.95.112.1	192.168.2.6
Nov 29, 2024 15:19:02.302964926 CET	80	49712	208.95.112.1	192.168.2.6
Nov 29, 2024 15:19:02.366632938 CET	49712	80	192.168.2.6	208.95.112.1
Nov 29, 2024 15:19:55.131030083 CET	80	49712	208.95.112.1	192.168.2.6
Nov 29, 2024 15:19:55.131094933 CET	49712	80	192.168.2.6	208.95.112.1
Nov 29, 2024 15:20:12.703603983 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:12.823612928 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:12.826272964 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:12.878798008 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:12.998684883 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:23.932977915 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:24.053081989 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:24.666363955 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:24.694813967 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:24.814881086 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:28.810945034 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:28.851253986 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:34.992785931 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:35.112859011 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:35.564790964 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:35.567275047 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:35.687197924 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:42.321335077 CET	49712	80	192.168.2.6	208.95.112.1
Nov 29, 2024 15:20:42.441489935 CET	80	49712	208.95.112.1	192.168.2.6
Nov 29, 2024 15:20:46.054965019 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:46.175061941 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:46.628007889 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:46.631035089 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:46.751075029 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:57.117516994 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:57.237407923 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:57.689915895 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:57.691756010 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:57.811768055 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:58.590492010 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:58.593384981 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:58.713365078 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:58.893906116 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:58.945075989 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:59.340611935 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.340642929 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.340656042 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.340704918 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:59.340976000 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.341039896 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:59.349106073 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.350256920 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.350332022 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.350334883 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:59.359163046 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.359215975 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:59.359219074 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.367237091 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.367319107 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.367471933 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:59.375972986 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.376104116 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:59.532516003 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.578258991 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:59.585669041 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:59.698344946 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.698460102 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:59.701263905 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:59.822087049 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.822139978 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:20:59.943412066 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:20:59.943490028 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:00.064891100 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:00.064973116 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:00.184848070 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:00.184921026 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:00.304888010 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:00.306109905 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:00.426881075 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:00.426980019 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:00.547149897 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:00.547219992 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:00.667432070 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:00.667515039 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:00.787523031 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:00.787599087 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:00.907604933 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:00.907671928 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:01.027715921 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:01.027780056 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:01.147908926 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:01.147964001 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:01.267997026 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:01.268066883 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:01.388170004 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:01.390386105 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:01.455982924 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:01.507535934 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:01.510443926 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:01.512110949 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:01.632103920 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:01.724010944 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:01.844403982 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:01.923265934 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:02.005191088 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:02.043426037 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:02.125490904 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:02.125543118 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:02.125610113 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:02.125623941 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:02.246597052 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:02.246666908 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:02.366655111 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:02.366714954 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:02.486670017 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:02.486727953 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:02.608516932 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:02.608571053 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:02.728506088 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:02.728571892 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:02.848645926 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:02.848702908 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:02.899454117 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:02.960680008 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:02.967999935 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:02.975847960 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.088387012 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.088481903 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.088530064 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:03.088536978 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.088587999 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.088617086 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.208667994 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.208750963 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:03.328819036 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.329282045 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:03.449405909 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.449995995 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:03.570470095 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.573359966 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:03.693439960 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.693634987 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:03.762113094 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.800132036 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:03.814054012 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.814591885 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:03.920368910 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.920445919 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.920478106 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:03.920527935 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.920538902 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.920561075 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.920671940 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:03.934688091 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:04.040694952 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:04.040774107 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:04.160742998 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:04.162283897 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:04.282219887 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:04.290200949 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:04.410254955 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:04.423652887 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:04.426019907 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:04.582052946 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:04.592772961 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:04.596157074 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:04.702876091 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:04.702888012 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:04.702897072 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:04.702907085 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:04.717683077 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:04.720026016 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:04.840092897 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:05.030144930 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:05.150141954 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:05.150188923 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:05.203906059 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:05.251380920 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:05.270164013 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:05.270210981 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:05.372246027 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:05.372291088 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:05.372441053 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:05.372539997 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:05.492114067 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:05.492172956 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:05.732671022 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:05.732784033 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:05.732788086 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:05.854098082 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:05.854165077 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:05.975438118 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:05.975522041 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:06.029169083 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.029419899 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:06.077856064 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:06.095606089 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.149518013 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.149595976 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:06.198087931 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.198103905 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.198127985 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.198196888 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.198249102 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.198292971 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.198347092 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.198421001 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.198457956 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.198661089 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.269598007 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.269660950 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:06.389714003 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.389847994 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:06.510056019 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.510253906 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:06.630423069 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.630516052 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:06.712577105 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.712688923 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:06.750128984 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:06.750639915 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.832664967 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.832827091 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:06.870301008 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.870404959 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.870655060 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.870663881 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.870671988 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.870680094 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.870692015 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.870745897 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.870817900 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.870896101 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.870975018 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.952828884 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:06.952908993 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:07.073160887 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.073226929 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:07.193341017 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.193394899 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:07.313668013 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.313716888 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:07.420403957 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.420598984 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:07.433712006 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.471556902 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:07.540863991 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.540909052 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:07.592387915 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.592401981 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.592411995 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.592421055 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.592431068 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.592439890 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.592448950 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.592457056 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.592464924 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.592473984 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.592482090 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:07.661072969 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:08.191411972 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:08.241940975 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:10.293091059 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:10.316144943 CET	49986	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:10.413044930 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:10.436276913 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:10.436297894 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:10.436476946 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:10.436492920 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:10.436506987 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:10.436526060 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:10.436570883 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:10.436587095 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:10.436705112 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:10.436722040 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:10.436762094 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:10.865014076 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:10.866269112 CET	49884	7000	192.168.2.6	103.230.121.124
Nov 29, 2024 15:21:10.986426115 CET	7000	49884	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:11.155461073 CET	7000	49986	103.230.121.124	192.168.2.6
Nov 29, 2024 15:21:11.202637911 CET	49986	7000	192.168.2.6	103.230.121.124

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 15:19:00.840665102 CET	59255	53	192.168.2.6	1.1.1.1
Nov 29, 2024 15:19:00.978753090 CET	53	59255	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2024 15:19:00.840665102 CET	192.168.2.6	1.1.1.1	0x5bc1	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 29, 2024 15:19:00.978753090 CET	1.1.1.1	192.168.2.6	0x5bc1	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 29, 2024 15:19:29.317481041 CET	1.1.1.1	192.168.2.6	0x8159	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 15:19:29.317481041 CET	1.1.1.1	192.168.2.6	0x8159	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Nov 29, 2024 15:19:29.317481041 CET	1.1.1.1	192.168.2.6	0x8159	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49712	208.95.112.1	80	2968	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 15:19:01.105918884 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Nov 29, 2024 15:19:02.302964926 CET	175	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 14:19:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	09:18:59
Start date:	29/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x630000
File size:	89'088 bytes
MD5 hash:	4347FB3A5B1EABF2E594A895A30B98F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3408817500.0000000002991000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.2125481379.0000000000632000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.2125481379.0000000000632000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3414135593.00000000129A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.3414135593.00000000129A1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3408817500.0000000002A5F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	09:19:01
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\file.exe'
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	09:19:01
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	09:19:09
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'file.exe'
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	09:19:09
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	09:19:25
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\java.exe'
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	09:19:25
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	09:19:28
Start date:	29/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	16
Start time:	09:19:44
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'java.exe'
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	17
Start time:	09:19:44
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	18
Start time:	09:20:08
Start date:	29/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "java" /tr "C:\Users\user\AppData\Roaming\java.exe"
Imagebase:	0x7ff79f0f0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	09:20:08
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	09:20:09
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Roaming\java.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\java.exe
Imagebase:	0x300000
File size:	89'088 bytes
MD5 hash:	4347FB3A5B1EABF2E594A895A30B98F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\java.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\java.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\java.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Has exited:	true

Target ID:	21
Start time:	09:20:18
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Roaming\java.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\java.exe"
Imagebase:	0x7ff642ec0000
File size:	89'088 bytes
MD5 hash:	4347FB3A5B1EABF2E594A895A30B98F4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	22
Start time:	09:20:26
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Roaming\java.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\java.exe"
Imagebase:	0x100000
File size:	89'088 bytes
MD5 hash:	4347FB3A5B1EABF2E594A895A30B98F4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	23
Start time:	09:21:01
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Roaming\java.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\java.exe
Imagebase:	0x700000
File size:	89'088 bytes
MD5 hash:	4347FB3A5B1EABF2E594A895A30B98F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true